a16z Reconsidering KYC: Institutions Embrace On-Chain, No Longer Trapped in Traditional KYC Framework

Original Title: The key to getting more institutions onchain: Rethinking KYC

Original Author: Maggie Hsu, Michele Korver, a16z

Original Compilation: Chopper, Foresight News

"Know Your Customer (KYC)" checks are often seen as obstacles to accessing the on-chain ecosystem in traditional finance and promoting the overall development of DeFi.

For those unfamiliar, these checks are a necessary part of financial institutions fulfilling their obligations to combat money laundering and terrorist financing under the Bank Secrecy Act (BSA). This process requires coordination among issuing institutions, verification agencies, and regulatory bodies, with varying incentives, timelines, and legal requirements for each party.

For banks, brokerages, and other institutions subject to the Bank Secrecy Act, the challenge of bringing tokenized products on-chain lies in how to reach more customers and gain liquidity while meeting compliance requirements, which may increase time and complexity. For example, when new customers register, institutions often need to repeat identity verification, even if the user has already completed similar verification elsewhere. Fortunately, new KYC tools designed specifically for blockchain hold promise for making identity verification results reusable, breaking free from outdated models inherited from traditional finance.

The starting point for discussion is clarifying whom institutions need to identify. In the traditional financial system, institutions conduct transactions through a network of intermediaries that have completed identity verification, with each institution independently fulfilling its own KYC obligations. This logic also applies to on-chain scenarios: a bank's customer identity verification obligations only pertain to its own customers, not every participant in the underlying settlement infrastructure.

The core of customer identity verification rules is who opens an account at the bank. According to this interpretation, a user does not become a customer of the bank simply by transacting with a bank customer or exchanging with a liquidity pool provided by the bank. As long as the bank establishes a suitable compliance system that covers its own customers and related transactions, it can meet the compliance obligations of the Bank Secrecy Act.

The U.S. Department of the Treasury is currently studying how financial institutions can leverage new technologies and methods to meet anti-money laundering/anti-terrorist financing (AML/CFT) requirements, including Customer Identification Programs (CIP) and KYC. With the implementation of the GENIUS Act, regulatory bodies need to explore and promote innovative solutions and standards to achieve modern anti-money laundering and anti-terrorist financing goals more efficiently.

This article will first analyze the legal conditions and practical prerequisites for implementing reusable KYC, and then discuss the roles that tools such as zero-knowledge proofs, verifiable credentials, non-transferable tokens, and on-chain data analysis can play. Finally, we will look forward to "Know Your Agent": identifying AI agents, the entities they represent, and the operational permissions granted.

Applying KYC to the On-Chain World

Traditional KYC processes are independently completed by various financial institutions. Each platform verifies identity through Customer Identification Programs (CIP) when users register for accounts, independently retaining records and continuously conducting customer due diligence. Identity information is kept by the institution, making it a trusted intermediary. When a user opens an account on a new platform, they must repeat the verification process, even if assets are circulating between individuals and businesses that have already completed identity verification.

Blockchain transactions add another layer of complexity. Assets are transferred across chains, protocols, and wallets, often without intermediaries to perform KYC. A wallet address may come from a regulated exchange, a DeFi protocol, or a consumer application. Each of these services has its own risk frameworks and responsibilities, and rules vary across different jurisdictions. Some intermediaries themselves have no KYC obligations, and even if KYC is a mandatory requirement, there is currently no unified regulatory framework that allows verification results from Institution A to be directly transferred for use by Institution B. Institutions are forced to repeatedly verify the same user, increasing costs and delays.

Former SEC Commissioner Peirce recently stated, "The approach to combating illegal financial activities has remained unchanged: collect as much data as possible. This method has not been effective; technological development has far outpaced this outdated system, and the time for change has come."

Financial institutions, blockchain developers, and regulatory bodies are creating new solutions to meet KYC and anti-money laundering, anti-terrorist financing goals. One direction is to allow institutions to reuse identity verifications completed by other entities. To implement this mechanism, clear rules need to be established to define which entities' verification results can be trusted and who bears compliance responsibility.

Reusability and Trust Ecosystem

Users want to undergo KYC verification only once and use it anywhere; this model is also known as reusable KYC, trust-based KYC, or custodial KYC.

In off-chain scenarios, users also undergo repeated verification. If a person opens accounts at two banks, both banks will require KYC completion, although ordinary users do not frequently open new bank accounts. However, in the crypto space, users continuously access new products, yet there is no trusted intermediary to ensure that KYC results remain valid throughout the transaction lifecycle.

Institutions do not wish to eliminate KYC; rather, they want to avoid redundant KYC. Each time a user connects to a new exchange or application, the KYC process starts anew. This is costly for platforms and creates barriers for users; as deepfake tools become more widespread, the reliability of traditional verification methods continues to decline. Banks and other institutions subject to the Bank Secrecy Act are burdened by this costly, privacy-invasive, and ineffective identity verification mechanism that fails to curb illegal financial activities.

Repeated verification means users must submit sensitive personal information to more institutions. Even submitting identification documents in digital form poses risks to users' personal safety, making them more susceptible to targeted scams, stalking, identity theft, and other illegal uses of information. Mobile identity credentials typically disclose a user's full name, address, date of birth, and photo all at once.

This type of centralized storage of personal identity information is a "honey pot" that is highly attractive to financial criminals. If information is intercepted, improperly stored, or if institutions retain data beyond the necessary period, the consequences can be severe. Coin Center points out that the existing system forces individuals to "repeatedly submit sensitive personal information to centralized databases, bearing significant personal risk." To avoid such unnecessary security hazards, privacy advocates urge regulatory bodies to consider alternative digital identity verification methods beyond government-issued identification records.

There is a reference case in the traditional financial market: SWIFT's KYC registry. Global banks have long used the SWIFT communication network to transmit cross-border payment instructions. In 2014, SWIFT launched the KYC registry, extending this infrastructure into the compliance realm: banks need only upload information once to share it with any counterparties in need. This registry now covers nearly 8,000 institutions in over 200 countries, and the core of this mechanism's operation lies in transactions occurring between institutions, where the identities of counterparties are known.

The crypto industry currently lacks a corresponding centralized registry. If Coinbase has completed KYC for a user according to bank-grade standards, can other platforms directly trust this verification result? If a user who has completed KYC with Robinhood wants to access an on-chain lending protocol, can Robinhood's prior compliance verification work be transferred with the user?

This is what is referred to as "whitelist liquidity." Accessing pre-verified user funds pools essentially constitutes the distribution of compliance capabilities, but it is not a legal requirement. Whether customers trade in a whitelist fund pool or an unlicensed fund pool, the institution's own compliance obligations remain unchanged. For tokenized securities, controlling access to fund pools and setting trading access standards may trigger regulatory obligations under the latest innovation exemption provisions from the U.S. SEC. Asset issuers are proactively connecting with major global exchanges, hoping to leverage the exchanges' compliance frameworks, but the corresponding business architecture is still being built.

Outsourcing and Compliance Trust

New solutions designed specifically for the crypto industry can reduce unnecessary data collection, providing auditable and verifiable alternatives to the past "process-driven" KYC. In fact, there are increasingly more cases of trust-based KYC being implemented in the crypto space.

KYC trust can also be understood as a "trust ecosystem": a trust network built by large-scale KYC service providers (or service provider alliances), similar to the concept of single sign-on. Service provider examples include Sumsub ID, World ID, MoonPay, and Stripe, which provides services through Privy. Initial verification generally charges the initiating platform $1 to $2, and subsequent platforms only need to conduct part of the KYC process (such as live detection), reducing the verification cost for individual users.

A recent case is Fireblocks' Open Trading Layer (OTL), an open protocol stack that standardizes identity, compliance, and messaging for participants in on-chain finance. Notably, KYC is completed by regulated entities within the network, not by OTL itself. OTL builds a shared protocol, and once a certain institution within the network completes user verification, other participants can recognize that verification status without needing to repeat the verification.

Another similar solution is Privado ID (formerly Polygon ID, spun off from Polygon Labs in 2024, recently merged with Disco.xyz), which implements reusable electronic KYC. Verifiable credentials are generated by issuers such as government agencies, banks, and KYC service providers; users apply for, collect, and store credentials in an identity wallet. Verifiers can query the corresponding credentials from the user's wallet, applicable in both on-chain and off-chain scenarios.

SpruceID is another solution built on identity standards. Trusted sources such as vehicle registration offices and state licensing agencies issue verifiable digital credentials, which users store on their phones. These tools simplify the reuse of verification results, but institutions must still be clear about their legal responsibilities when trusting third-party verification results.

Institutions can outsource KYC operations, but the legal characterization depends on the service provider and collaboration model. According to the FFIEC's Bank Secrecy Act/Anti-Money Laundering Handbook, trust is a specific legal term that only applies to trusting the verification results of another regulated financial institution. If the partner is an identity verification supplier or credit agency that does not meet qualification requirements, it can only be considered outsourcing. In this case, the institution still needs to independently bear full responsibility for the Customer Identification Program.

Similarly, the Financial Action Task Force (FATF), which sets global anti-money laundering/anti-terrorist financing standards, stipulates that countries may allow financial institutions to delegate part of the customer due diligence work to third parties, but three conditions must be met:

1. The third party itself is subject to anti-money laundering and KYC-related regulation and supervision and has corresponding compliance measures;
2. The trusting institution can, upon request, access the underlying KYC raw data immediately;
3. The trusting institution bears full legal responsibility for the final compliance results.

These rules cannot be directly applied to the crypto industry. First, the requirement for "immediate access to raw data" means that regulatory or law enforcement agencies need to access users' personal identity information at any time. This directly conflicts with the privacy protection designs of most on-chain KYC solutions.

Furthermore, many crypto platforms do not meet the definition of "regulated entities" as defined by U.S. federal anti-money laundering and customer identification trust rules, even if they are registered money service businesses or state-chartered trust companies that bear their own anti-money laundering obligations. Therefore, they cannot serve as counterparties in formal trust relationships.

This is an obstacle that must be addressed as the U.S. Treasury promotes a more flexible, native cryptocurrency customer identification solution. Decentralized solutions are lower in cost, more efficient, and better protect user privacy while reducing the risk of data breaches; however, law enforcement agencies still require a trusted source to confirm the true identity of users and provide written evidence for investigations or court presentations.

In addition to anti-money laundering project requirements, financial institutions must also comply with funds transfer rules, commonly known as the "travel rule." Any financial institution or virtual asset service provider (VASP, which in the U.S. includes institutions governed by the Bank Secrecy Act that transfer amounts exceeding a threshold, typically $3,000; other jurisdictions may have lower thresholds) must collect and transmit the identity information of both the payer and the payee to the next institution in the chain. This process flows smoothly in traditional financial scenarios because banks already hold KYC data and have established messaging channels like SWIFT to transmit information. However, in the cryptocurrency space, on-chain transactions and KYC information are separated.

Several mature service providers offer compliance solutions for the travel rule specific to the cryptocurrency industry. This includes TRUST (Travel Rule Universal Solution Technology) launched by the industry alliance Coinbase, as well as similar products from Notabene and Sumsub.

In the U.S., the travel rule messaging requirement only applies to transactions between financial institutions. Financial institutions and virtual asset service providers are not required to send such data to non-financial institutions or non-VASP entities (such as self-custody wallets).

Financial institutions do not need to overly worry about travel rule compliance when interacting with non-intermediary blockchain technologies like DeFi and self-custody wallets. Banks or exchanges can still require users to provide information for deposits and withdrawals involving self-custody wallets, which falls under the institution's own risk-based anti-money laundering/anti-terrorist financing project requirements, but the travel rule itself does not impose such a mandatory requirement.

However, positions in jurisdictions outside the U.S. vary regarding the monetary threshold that triggers the rule and whether VASPs must collect data from non-VASP individuals/entities; policies in various countries are still being formulated. Regulatory agencies around the world are still exploring how to apply KYC, anti-money laundering, and travel rules to on-chain scenarios.

The good news is that the U.S. does not need new specialized legislation. Existing laws and regulatory frameworks can be adapted through regulatory guidance, rule amendments, or innovative exemptions. Congress has already recognized the responsibility allocation logic mentioned above. The GENIUS Act assigns anti-money laundering and sanctions obligations to licensed stablecoin issuers, which are identifiable entities at the application layer, rather than the unlicensed underlying networks of stablecoin circulation. Regulatory agencies also recognize the value of new technologies in the compliance field. In a proposal from FinCEN in April 2026, machine learning, generative AI, digital identity, blockchain monitoring analysis, and API interfaces were listed as innovative solutions to meet regulatory obligations.

FinCEN's proposal supports financial institutions in adopting emerging technologies, indicating that institutions "responsibly experimenting with innovative technologies in anti-money laundering/anti-terrorist financing projects will not face significant regulatory scrutiny or enforcement actions solely for using innovative technologies." To facilitate practical implementation for institutions, the cryptocurrency industry calls for FinCEN and banking regulators to clarify through formal rules or written guidance when digital identities can be used to meet anti-money laundering project requirements, including customer identification CIP/KYC.

Even with clearer regulatory guidance, not all KYC determinations can be simplified into binary cryptographic proofs. Zero-knowledge proofs can demonstrate date of birth, nationality, sanctions screening results, and proof of possession; however, more complex anti-money laundering investigations that require human judgment still rely on traditional due diligence.

Verifiable credentials can assist or even replace certain aspects of customer identification CIP/KYC, but will not completely replace risk-based customer due diligence. Current Treasury rules already allow non-documentary verification methods, and institutions can use a combination of various verification methods based on their own risk assessments. FinCEN's September 2026 FAQ explicitly recognizes that qualified verifiable digital credentials can be used for banks' customer identification projects, but does not fully endorse all decentralized identity or credential designs.

FinCEN and relevant banking regulators can refine guidance based on existing authority. Optional approaches include: issuing interpretive guidance, adding FAQs, targeted exemptions, pilot projects (approval after pilot completion), credential issuer standards, or amending regulations. This plan allows traditional financial institutions and qualified public or private entities to issue verification credentials according to unified standards, reducing the need for each bank to build the same identity profile repeatedly.

Before this, financial institutions could already use tools that comply with existing rules. Below are feasible implementation ideas.

Feasible Solutions

Institutions can rely on a trusted, compliant backend system to allow identity credentials to be reused across various on-chain applications. Trusted service providers verify user identities and generate digital signature credentials to record verification results. Users present this credential to other applications, which only need to verify the credential issuer's qualifications to confirm whether they meet their own verification standards.

This concept is not new and can be traced back to Vitalik Buterin's idea of soulbound tokens proposed in 2022. Supporting solutions also include W3C standards for decentralized identity (DID) and verifiable credentials, which are not exclusive to the cryptocurrency industry.

In practice, compliant KYC service providers, banks, or even governments act as trusted issuers to verify user identities and issue credentials. Credentials are stored in the user's wallet, and users can selectively disclose information to the applications they need.

Similarly, zero-knowledge succinct proof systems allow users to prove they have completed KYC without disclosing personal identity information, thus protecting privacy. Users can reuse this credential, provided it meets the receiving institution's customer identification CIP requirements, reducing redundant verification.

The verification mechanism also needs to be composable, allowing applications to embed verification logic into their own compliance checks. More specifically, to maximize effectiveness, issuers and platforms can embed this logic into token contracts and application-layer smart contracts. Institutions can execute their own compliance requirements without external components and do not need to embed compliance logic into the underlying public blockchain network.

Implementation Methods

There are other feasible tools to help financial institutions meet risk-based anti-money laundering project requirements: Know Your Wallet (KYW), Know Your Assets (KYA), and Know Your Transactions (KYT). Exchanges and money transfer service providers have already incorporated such methods into their overall anti-money laundering solutions.

Know Your Wallet (KYW)

KYW binds identity verification to the blockchain address used by the customer, helping institutions confirm the actual controller of the wallet and what assets and services the customer is qualified to access. KYW includes:

• Identity Binding: Generally done during the account opening KYC phase, binding real identity to wallet address;
• Liveness and Uniqueness Verification: Confirming the identity is a real human being, with no duplicate identities across wallets; and regularly refreshing the binding relationship to ensure the same real identity continues to control the wallet;
• Access/Permission Control: After wallet verification is completed, specific access permissions are granted (whether the user is a qualified investor, whether their location is compliant, whether they can hold specific types of assets), which is the compliance access layer.

KYC in the cryptocurrency field mostly follows traditional models. Service providers like Onfido, Veriff, Trulioo, Socure, Incode, ID.me, Persona, Sumsub, and Sardine offer identity binding, document verification, liveness detection, and anti-money laundering screening. Most of this identity verification is done off-chain, and verification alone cannot confirm which wallet address the user controls; binding the verified identity to the wallet address is an additional step.

On-chain applications can use non-transferable tokens to record verification results, employ zero-knowledge proofs to limit personal information disclosure, and use human verification solutions to confirm the user is an independent real person. Multiple solutions can be combined.

This approach uses non-transferable, non-sellable tokens, often referred to as soulbound tokens, permanently binding to a specific wallet address. Within the KYW system, compliant service providers complete user identity verification off-chain and mint a token in the user's wallet as a verification record. Quadrata is an example of this type of solution, generating soulbound tokens to verify attributes such as user nationality and age.

These tokens facilitate audit record verification, but their non-transferability does not prevent others from taking over the wallet. For example, if a wallet's private key is stolen or control is transferred, the identity corresponding to the token no longer matches the current wallet controller. The system also needs mechanisms for credential expiration and revocation, depending on product implementation; Quadrata supports issuer revocation of credentials.

Related solutions embed compliance logic into asset tokens. DTCC's ComposerX, a tokenization platform for institutions, employs a Compliance-Aware Token Framework (CATF) to enforce regulatory and trading rules during transaction execution. Whether asset transfers can succeed depends on whether compliance conditions are met.

There are also startup projects planning to issue identity tokens, such as Burrata, which had a feasible technical solution but insufficient product-market fit and has since shut down.

Zero-knowledge proofs address another layer of pain points: users can prove identity-related claims without disclosing the underlying raw data. Many solutions already exist that can generate zero-knowledge proofs through document scanning.

• Self.xyz offers a privacy-protecting "pre-KYC" solution: users scan physical passports to generate zero-knowledge proofs of passport information, proving they are over 18 years old and not on sanctions lists. This can serve as a preliminary screening layer before formal KYC, filtering out bots and sanctioned wallets, saving time.
• Ethereum privacy L2 Aztec acquired zkPassport, adopting a similar approach to scan passports and generate zero-knowledge proofs.
• Opacity Labs uses a zero-knowledge transport layer security protocol (zkTLS); its trusted data network VDN can generate verifiable proofs for any Web2 facts (such as account ownership, transaction history) and transmit them on-chain without disclosing the underlying raw data.

Finally, there are human verification solutions. These solutions do not verify who the user is but only confirm that the wallet is controlled by a unique, real human.

Worldcoin's World ID collects iris biometric information through dedicated hardware called Orb to prove human uniqueness. After capturing iris images, the Orb encrypts and transmits them to the user's phone, deleting the original images from the device; it generates a hash value to compare with other hashes to complete the uniqueness verification. Users generate key pairs in the World App and create zero-knowledge proofs when they need to prove their unique human identity.

Human verification combined with identity binding (proving who this real person is) can strongly resist deepfakes and reduce identity impersonation in certain scenarios, such as bank account openings. World has partnered with Zoom to compare user video footage with World ID, marking Zoom accounts as "verified human." Another solution, Human Passport, was initially used to protect Gitcoin funding projects, providing modular identity verification and witch attack defense tools.

Please note: Human verification can only address witch attack and deepfake issues and cannot meet regulatory identity verification requirements; to form a complete solution, it still needs to be combined with other KYC methods.

The above solutions focus on the individuals behind the wallets. The assets themselves also bring another set of compliance issues, including asset sources, holding, and transfer permission restrictions.

Know Your Assets (KYA)

KYW focuses on who holds the assets, while KYA focuses on what can be done with those assets and who can trade with them.

Overall, anti-money laundering laws are broad. The Bank Secrecy Act does not concern itself with asset types; asset categories are more qualitatively assessed by market regulatory agencies: whether they belong to securities or commodities, etc. However, Know Your Asset (KYA) is an important tool for financial institutions to assess various compliance risks. KYA focuses on the source of assets: how assets are issued, by whom they are issued, including compliance attribute verification during the issuance phase and throughout the entire lifecycle.

The most direct implementation method is to write transfer restrictions into the token contract at the time of token issuance. The RWA tokenization platform Securitize embeds compliance logic at the token level. When issuing BlackRock BUIDL and Apollo ACRED, the token contract mandates that transfers can only occur between whitelisted wallets. Assets do not rely on external access layers; the token contract directly enforces transfer restrictions. Ondo's OUSG and Superstate's USTB adopt a similar model: with each transaction, the transfer hooks verify the on-chain whitelist, and both the sender and receiver must complete verification before settlement can be executed.

An unresolved challenge in the KYA field is asset traceability: it is necessary not only to confirm token attributes but also to trace the source of assets. Tokens issued by regulated platforms with clean KYA records have clear origin records. However, when tokens bridge, are packaged, or used as collateral in DeFi protocols, the traceability chain may be compromised. The issuance phase can generate clear initial records; however, maintaining and interpreting this record during subsequent asset circulation remains a challenge, which is also related to the Know Your Transaction (KYT) due diligence discussed below.

However, this is more of an operational challenge rather than a liability trap. The U.S. Office of Foreign Assets Control (OFAC) does not require institutions to assume the sanction risk of every address that assets pass through. Blockchain analysis tools can differentiate between direct risk exposure (assets directly transferred from sanctioned addresses) and multi-hop indirect exposure. Institutions manage the latter through risk thresholds, asset isolation, and suspicious transaction reporting, rather than rejecting all assets that flow through unlicensed infrastructure.

Know Your Transaction (KYT)

KYT helps institutions assess the aforementioned risks, track connections between different wallets, and map the flow of assets between wallets.

Transaction monitoring is a fundamental tool for financial institutions to observe customer behavior and identify suspicious activities that need to be reported. For a specific asset, KYT can map the entire lifecycle transaction history, showing which wallets and protocols the asset has interacted with. In simple terms, KYT focuses on examining the transaction itself, which can be independent of or in conjunction with the identity verification of the transaction parties. This set of tools meets the requirements for Continuous Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD).

Blockchain analysis service providers such as Chainalysis, Elliptic, and TRM can track wallet relationships and trace the flow of funds across chains and protocols. Coupled with on-chain and off-chain data as well as emerging AI tools, these products help financial institutions meet compliance obligations related to the Bank Secrecy Act and sanctions.

Examples of related AI tools include Eunice.ai, which processes risk monitoring and information disclosure based on an asset classification framework; Didit, which provides screening and transaction monitoring for real-time risk analysis by wallet; and Sardine.ai, which completes initial screening while providing daily ongoing transaction monitoring.

In addition to KYW, KYA, and KYT, some blockchains and protocols have built-in compliance control functions.

Blockchain Layer Solutions

Permissioned chains and permissionless public chains are providing more tools to achieve access control and protect privacy. These tools can intercept transactions before conditions are met while safeguarding sensitive information from disclosure, retaining regulatory audit channels.

The Bank Secrecy Act and sanctions regulations do not require verification nodes to be permissioned, identify all participants in the network, or impose access controls across the entire network. Regardless of which network is used, institutions only need to be responsible for their own customers and transactions. Institutions can choose from the solutions below based on their business and product needs, provided they meet compliance obligations.

For example, Canton is a public permissioned network where transaction details are only open to relevant parties who need to know under a transaction privacy model, with compliance logic deeply integrated with smart contracts. Another example is Circle's Arc, where verification nodes operate under a permissioned model, but the chain itself is a public chain; verification nodes are all real-name participants who have completed KYC/KYB verification. In contrast, permissionless protocols allow the protocol itself to choose verification nodes for each transaction. Processing this transaction does not make the verification node a counterparty to the institution or customer.

Some permissionless protocols also support access control funds, gateways, or rules, facilitating institutional users in managing access permissions. Solana achieves compliance through token expansion features; with transfer hooks, each transfer checks the on-chain whitelist, and only transactions where both the sender and receiver are on the whitelist can be executed. The asset layer enforces mandatory checks, while the underlying network remains permissionless, with whitelists generally generated off-chain.

Uniswap v4, as a permissionless protocol, comes with hook functionality that can mount custom logic at key points in the exchange lifecycle, allowing for the creation of permissioned liquidity pools. The tokens themselves remain permissionless, with only the liquidity pool setting access thresholds. Third parties deploying liquidity pools with access restrictions do not turn the protocol itself into a permissioned chain; the entity deploying the liquidity pool and setting access rules assumes related obligations. Hyperliquid also supports the HIP-3 proposal, allowing deployers to restrict transactions to approved addresses.

The decentralized lending protocol Morpho allows users to build compliance controls with market participants. The protocol itself does not execute KYC or identity verification. In the Morpho Blue variable interest rate lending protocol, if the market uses KYC-compliant USDC or similar whitelisted tokens as collateral, compliance controls can be implemented at the asset level, allowing only verified users to interact with that specific market.

Morpho Midnight, based on intent-driven fixed interest rate lending protocols, and Morpho Vaults V2, can set access permissions more flexibly. Morpho Vaults V2 allows independent managers to set custom access thresholds, restricting borrower qualifications so that capital can be allocated across networks to borrowers with specific compliance qualifications. This modular design allows institutions that wish to transact only with verified counterparties to use permissioned markets and vaults without compromising the liquidity efficiency of the entire protocol ecosystem. This is a choice of product and risk preference; an institution's own compliance obligations do not depend on whether other participants in the shared market have completed verification.

Cross-Chain Compliance Information Transmission

Access control determines who can participate in specific markets or vaults. When assets are transferred across chains, issuers and applications face another challenge: transmitting relevant compliance information and executing unified rules across multiple networks.

LayerZero supports the cross-chain transmission of "compliance status," eliminating the need to rebuild and maintain compliance logic on each chain separately. Its Omnichain Fungible Token (OFT) standard supports custom logic hooks, requiring compliance checks to be completed on both the source and target chains before asset transfer settlement.

LayerZero V2 introduces a configurable Decentralized Verification Network (DVN) to verify cross-chain messages. The DVN can be configured to enforce compliance checks: checking whether users/wallets have completed KYC, screening addresses against sanction lists, and confirming that messages include travel rule metadata before determining message validity.

Chainlink similarly bridges off-chain verification with on-chain compliance needs by using the Chainlink Automated Compliance Engine (ACE) to bring KYC service provider data on-chain. ACE enables reusable KYC, supporting cross-chain binding of user wallets: verification and registration can be done once and called multiple times.

Macro Perspective

These tools address different aspects of on-chain compliance. When implemented, they need to integrate with existing compliance systems to allow tokenized products to reach customers.

The simplest short-term approach is to collaborate with exchanges that already have mature compliance systems to reach more customers, but this is not a mandatory compliance requirement. Issuers can also directly embed control logic into the tokens themselves; BUIDL, OUSG, and USDC are examples of this type, allowing assets to flow on public chains while being constrained by the rules within the contracts.

The next opportunity is to make compliance verification results reusable within the DeFi ecosystem. In other words, applications and institutions can rely on verification information provided by other service providers and evaluate it against their own standards. The implementation of this system will likely depend on unified protocol standards, compliance-focused software service providers, and traditional platforms with existing KYC users for distribution.

Future Direction: Know Your Agent

Reusable credentials can confirm the identity of human customers. However, when AI agents conduct transactions on-chain, manage vaults, or initiate payments on behalf of users, institutions still need to confirm: who authorized this agent and what operational permissions the agent has. Know Your Agent extends this discussion to software that performs operations on behalf of clients, defining its permission boundaries.

Just as humans need credit scores to apply for loans, AI agents also require cryptographic signature credentials for transactions. This is the emerging Know Your Agent framework: a KYC for AI agents. Without a comprehensive Know Your Agent framework, liability issues may arise, leading to situations where no one is accountable, yet everyone could potentially be liable.

The Know Your Agent framework requires new types of credentials to prove who authorized the agent, who they represent, and under what constraints they operate. Each agent must be identifiable, registrable (linked to an individual or corporate entity), have a reputation record, and verify permission constraints before interactions. Some solutions operate on-chain, while others operate off-chain, but an increasing number of solutions share the same cryptographic foundational primitives, including RFC 9421 signatures and W3C verifiable credentials.

On-Chain Solutions

The ERC-8004 standard will be deployed to the Ethereum mainnet in January 2026 and is the first significant on-chain standard for AI agent identity, with over 30,000 registrations in the first week of launch. It provides an on-chain system for registering AI agents, tracking reputations, and recording independent verification results. Each agent is minted an ERC-721 token that points to the agent's registration file. On-chain records are immutable, possess trusted neutrality, and are composable, reducing reliance on a single platform.

Self.xyz's Self Agent ID, based on this standard, is an on-chain identity registration system that binds AI agent identities with Self's human identity verification. Each agent has a non-transferable NFT backed by passport verification, allowing applications to reuse this credential to verify that the agent is a real human.

Advantages of on-chain Know Your Agent solutions: immutable, trusted neutrality, composable.

Off-Chain Solutions

Many solutions use off-chain credentials and signed messages to identify agents and define permissions, even if payment actions occur on-chain.

• Google Proxy Payment Agreement AP2 uses signed messages to record user instructions, including spending limits and procurement conditions, retaining verifiable evidence of authorization obtained by the proxy.
• Catena Labs Proxy Business Toolkit proposes the ACK v2 scheme, using signed authorization letters that specify who authorizes the proxy and the scope of authorization. Each request is accompanied by an authorization letter and an HTTP message signature (RFC 9421).
• Skyfire KYAPay allows proxies to self-verify their identity and represent the principal; it uses a signed digital credential called JSON Web Token (JWT). Skyfire collaborates with Yibo Rui Agent Trust framework to bind proxies with verified consumers and devices.
• Circle Proxy Wallet focuses on custody and permission control. The signed key shards are invisible to the proxy, and users retain custody of their assets. Proxies can only trade autonomously within the spending limits and recipient restrictions set by the user.
• Anchorage Proxy Banking Services bind credentials to users or institutions, granting proxies permission to spend from a designated budget. Transactions leave a trace under the proxy's identity, and permissions can be revoked at any time.
• Mastercard Agent Pay registers proxies, binding proxy payments with consumer authorization and tokenized payment credentials. It collaborates with Cloudflare to use signed network requests to help merchants verify AI proxies accessing their websites.
• Visa Smart Commerce replaces card information with digital payment tokens, confirming that the proxy has the consumer's operational authorization and setting spending limits.
• Zero Hash Proxy Financial Suite screens AI proxies and their underlying entities before transactions. It supports user delegation of permissions and transaction control.
• Ledger is building a solution to connect secure hardware with authorized humans. Its roadmap includes hardware-enforced spending rules, with sensitive transactions requiring manual approval.

Delegating financial operations to AI proxies raises issues related to authorization and control, returning to the underlying topic of how institutions apply compliance verification to products and services.

Bringing the financial system onto the blockchain is also an opportunity to optimize the compliance system. Most of the above solutions do not require new legislation. Existing rules from the Treasury Department already recognize non-documentary verification methods, and the FAQ from September 2026 acknowledges verifiable digital credentials for Customer Identification Program (CIP). FinCEN has stated that institutions will not face enforcement penalties as long as they responsibly experiment with new technologies. Institutions looking to avoid redundant KYC processes can start with existing tools.