You Can't Jail an Agent

From KYC to KYA: Banking the Machine-Speed Economy

By Carel de Jager · Sixpence · 23 July 2026

There is a question I have started putting to people who run banks, and it reliably ruins their afternoon: what do you do with a customer you cannot punish?

Everything in financial regulation rests, at the very bottom, on a person with something to lose. Know Your Customer, the body of law that obliges a bank to identify who it serves, exists so that when money moves for the wrong reasons, someone can be fined, struck off, or imprisoned. The whole fortress of anti-money-laundering rules is built on that foundation. I know the fortress well. I build payments infrastructure in Johannesburg, and in 2023 the Financial Action Task Force, the global money-laundering watchdog, greylisted South Africa. I spent the years that followed watching from the inside what that pressure does to a banking system: correspondent relationships wobble, compliance budgets balloon, and every institution relearns, urgently, why the rules exist.

So I take the fortress seriously. Which is why the arrival of AI agents that hold wallets, negotiate terms and initiate payments triggers specific thoughts. An agent has no body to imprison, no career to end, no reputation it was born caring about, and no assets unless someone gives it some. Threaten it with jail and you are threatening a process ID. The industry's reflex has been to file this under "compliance problem" and wait for regulators to sort it out.

The reflex is understandable and the conclusion is wrong. What follows is my attempt to work out what actually happens to banking when the transacting party stops being human. It took me somewhere I did not expect: the biggest opportunity banks have had in decades sits directly on top of their scariest compliance problem, and the institutions that solve the second get to own the first.

Two percent of the ceiling

When I first pulled this thread, I did what every founder does with a big idea: I reached for a napkin. Eight billion people. Assume a manic upper bound of a thousand payments per person per month, far beyond anything a human actually does. That gives a theoretical ceiling of about a hundred trillion transactions a year. The machine economy, I reasoned, would blow through the human ceiling, and that was the story.

Then I checked the actual number and felt a little silly. The world makes roughly 1.7 trillion cashless payments a year, which works out to about seventeen per person per month. We sit at two percent of my generous ceiling. Humanity is nowhere near its biological limit for transacting. What binds us is friction: the cost, the hassle, the small tax of attention that every payment charges.

India proved this at national scale. When UPI made payments free and instant, annual volumes went from eighteen million transactions to a hundred and eighty-six billion in under a decade, a roughly ten-thousandfold increase, most of it tiny payments that used to be cash or simply never happened. Brazil's Pix tells the same story. Cash fell from 43 percent of transactions to 6 in five years. Remove the friction and humans transact ten times more. Sometimes a hundred.

But underneath friction sits a floor that no payment redesign removes. Every human payment, however cheap, spends a moment of attention. Somebody has to notice the price and agree to it. Attention is the one input the payments industry cannot manufacture, and it caps out at a few dozen deliberate economic decisions per person per day.

Agents remove the consenting mind from the loop. When software decides within a mandate, the marginal cost of an economic decision becomes the marginal cost of inference, and that cost has been falling by roughly ten times a year. For the first time in economic history, the number of transactions is decoupling from the number of people. It re-couples to compute and energy. I suspect the honest unit of measurement for the machine economy will eventually be payments per kilowatt-hour.

Automated is not autonomous

The obvious objection is that machines already transact, constantly. Your gym membership renews itself. Trading algorithms move more shares than people do. Advertising exchanges run hundreds of billions of auctions every day. All true, and none of it broke the regulatory model, because all of it is automation: the execution of terms a human approved in advance, with counterparties a human chose. Somewhere at the root of every direct debit and every algo strategy is a signed mandate, and that signature is the compliance anchor. The regulator can always walk the chain back to a pen.

Autonomy is a different animal. An autonomous agent picks counterparties you never named, on terms you never saw, in pursuit of a goal you stated loosely. Keep the fleet running under budget. The ladder between the two has rungs: software that executes standing instructions, then software that recommends while a human clicks approve, then software that decides within limits, then software that manages a treasury and takes risks over months. Most of what is being deployed right now is the move from "recommends" to "decides." The interesting problems, and this essay, live on the upper rungs.

Framed that way, the compliance question stops being mystical and becomes an engineering requirement: maintain an unbroken, verifiable chain from any autonomous action back to someone who answers for it. Hold that sentence. The rest of the argument hangs off it.

The bar tab principle

For a while I told people that payments would soon stream like data, millions per second, a meter running on everything. I have stopped saying it, because it confuses two things the plumbing of finance has always kept separate: what is owed and what is settled.

Two friends at a bar don't tap cards after every round. They run a tab and settle once. Finance does this at planetary scale and calls it netting. CLS, the utility that settles most of the world's currency trades, once processed 19.1 trillion dollars of payment instructions in a single day using 72 billion dollars of actual funding, about a third of one percent of the gross. The advertising industry runs 178 trillion real-time auctions a year in the US and Europe alone, more than two hundred times the card payments the entire world makes, and settles them as monthly invoices. On a fair reading of the data, fewer than one machine interaction in a thousand ends in an actual, discrete movement of money.

There is a 25-year-old essay that explains why this keeps happening. In 1999 Nick Szabo argued that the fatal cost in micropayments was cognitive: deciding whether something is worth two cents costs more than two cents. Every micropayment startup since has died on that hill. Agents genuinely kill Szabo's constraint, because the deciding mind is now silicon and thinks for a fraction of a cent. Two costs survive the human, though. Every rail charges something per final settlement, and every mandate carries risk that a principal must cap. Both push in the same direction Szabo's did. Toward the tab.

You can watch it happen in real time. x402, the protocol Coinbase revived so that agents could pay per web request, launched on the promise of true per-call payment and moved to prepaid deposits with periodic settlement within its first year, once per-request fees started exceeding the cost of the service being bought. The agent economy began netting itself before its first birthday.

Szabo, to his credit, saw the agent argument coming in 1999 and rejected it. His objection: you could never verify that the agent serves you rather than the seller. He was right that verification is the hard part. Verification is the entire second half of this essay.

So here is the shape of the machine economy, drawn honestly. At the top of the stack, machine decisions and interactions can plausibly grow a hundredfold or a thousandfold. Little but compute limits them. In the middle, payment obligations grow more slowly, because most decisions never involve money. At the bottom, final settlements grow more slowly still, because netting swallows the rest. And beneath all of it, actual economic value barely moves. Even the breathless AI forecasts add tens of percent to global GDP, an order of magnitude short of doubling it.

Figure 1: The wedge. Counts explode, settlements grow modestly, value barely moves. Illustrative paths, log scale, 2024–2040.

Read the wedge as a strategy document and one conclusion falls out. Charging a fee per payment is a shrinking prize, because the unit economics of the settlement event are heading toward zero even as events multiply. The durable position sits a layer down, with whoever runs the tab: netting the obligations, vouching for the actors, and lending against their record. Every previous machine explosion ended the same way, with the netting layer capturing both the economics and the data. Google cleared the ad auctions. Visa and Mastercard cleared the card swipes. CLS cleared the currency trades. The agent economy will get its equivalent, and it has not been built yet.

Four businesses, four different fates

People say "banks" as if a bank were one business. It is at least four, and the machine economy treats them very differently.

Payments, the business of moving money, gets more volume and worse economics. See the wedge.

Deposits, the business of holding money, is where the surprise lives, and it is unpleasant. Much of banking's profitability rests on inertia: balances that sit, customers who never shop rates, float nobody optimizes. The liquidity rules governing how much banks hold against deposits are calibrated, in effect, to human sluggishness. An agent treasurer has no sluggishness. It sweeps every idle cent into yield, continuously, and it moves at the first sign of trouble. When Silicon Valley Bank failed, depositors pulled 42 billion dollars in a day and had over 100 billion queued for the next morning, using nothing faster than smartphones and group chats. Give the same instinct to software and a bank run becomes an intraday event, perfectly correlated across every agent watching the same signal. My best guess at the equilibrium: agents keep working balances in bank money, increasingly the programmable, tokenised kind. They park surplus cash in tokenised money-market funds that actually pay interest, and hold stablecoins only in transit. Banks keep the accounts and lose the laziness. The deposit base gets thinner, faster, and more expensive.

Credit, the business of taking risk on borrowers, is the genuine frontier. It gets its own section below.

And the fourth business, the one banks rarely put on the org chart, is trust: being the institution that says who somebody is and stands behind the statement. That one is an open race, and the last third of this essay is about it.

You couldn't jail a corporation either

Back to the opening problem. No body to imprison, nothing to lose. It sounds fatal until you notice that banking already serves, at enormous scale, a class of customer with exactly those properties.

You cannot jail a corporation. Nobody has ever handcuffed one. A corporation is a legal fiction with no body, no conscience and, at the moment of its creation, no assets. Four centuries ago that was a radical problem, and society solved it without ever putting a company in prison. It built an accountability stack instead. Charters and registries, so you know the thing exists and who stands behind it. Mandatory audit, so you can inspect it. Limited liability, paired with the power to pierce the veil when the fiction is abused. Insurance, to make victims whole. And the corporate death penalty, revocation of the charter. Fines and death, in place of jail. Banks have lent to unjailable customers for hundreds of years, comfortably, because the stack works.

Know Your Agent, the term now circulating for agent-era compliance, is that stack rebuilt for actors created in milliseconds instead of weeks. The parts translate almost one to one. Registration binds an agent to an accountable principal. A signed mandate defines what it may do, with what budget, until when. Bonds and insurance put capital behind its behaviour. And revocation becomes something the corporate world never had: an economic death penalty administered in milliseconds, with a public revocation log that functions as the agent's criminal record.

The law is further along here than most technologists assume. When Air Canada's chatbot invented a refund policy, a tribunal made the airline honour it. Liability flowed up to the principal, exactly as agency law says it should. Electronic-transactions statutes on several continents, including South Africa's, have attributed the acts of automated systems to the people who deploy them since the early 2000s. The UN's trade-law body adopted a model law on automated contracting in 2024. Even the money-laundering rulebook contains the hook: FATF's own standards already require a bank to verify that anyone acting on behalf of a customer is authorised to do so, and to identify that person. Nobody wrote that sentence with software in mind. It stretches surprisingly far.

What actually changes is the question compliance asks. Today, every investigation terminates at a human: the ultimate beneficial owner, the person who ultimately controls the money. In an economy of delegated software, with agents spawning sub-agents across jurisdictions, the terminating question becomes: which pool of capital answers for this behaviour? Call it the ultimate answerable capital. Find that, bond it, and price it, and you can serve a customer you cannot punish.

Everyone thinks KYA is plumbing

I should be honest about the term. I did not coin Know Your Agent. Card networks use it, the IMF has written about it, and a shelf of startups will sell you KYA middleware today. Almost all of it treats KYA as an identity problem: verify the agent, check the box, move on. Necessary work, and it misses where the money is.

Here I need to confess something and define two words. I have never worked in a bank, and when I began writing about "reputation-based lending," a banker gently informed me that the industry has vocabulary for this. Lending against collateral is secured lending. Lending against your read of a borrower's character and capacity is unsecured lending, and the craft of pricing it is underwriting. Underwriting may be the oldest franchise banks own. For four centuries their edge has been converting reputation into credit better than anyone else, because they sit on the best behavioural sensor ever built: the operating account. Watch the money flow and you know the borrower.

Now look at what an agent produces. Every task, every counterparty, every mandate honoured or breached, every dispute, cryptographically logged from the moment of its creation. An agent's telemetry is a richer credit file than any human ever generated, and it starts accumulating on day one. The institution that turns that telemetry into underwriting inherits the old franchise on a new species.

And here is the part of the story I find most elegant: credit is the enforcement mechanism. Nobody legislated credit bureaus into existence. Nineteenth-century merchants joined them voluntarily, because rated firms got trade credit and unrated firms paid cash up front. The market priced the unrated. The same mechanism transfers cleanly. An anonymous agent can still transact, but on cash terms: prefunded, low limits, high fees. An identified agent, bonded, telemetry-sharing and mandate-bound, gets limits, speed and credit, and its principal gets working capital. No parliament needs to pass anything for this to happen. A price list does the work of a statute.

KYC was imposed by law. KYA will be imposed by price.

Figure 2: The trust flywheel. Verified behaviour compounds into credit. Credit disciplines behaviour.

What does the lending product look like in practice? Boring, at first, which is a compliment. The borrower stays the company, because someone enforceable has to owe the money. The agent draws inside a machine-specific risk envelope: a ten-million-dollar working-capital line where the procurement agent may draw half a million, only against approved suppliers, with single transactions capped, limits tightening automatically when the agent's model version changes, and autonomy suspended the moment a fraud signal fires. That is corporate banking extended one layer downward, and every component of it exists today.

The map, honestly drawn

Now the sober part. Measured honestly, the agent economy is currently tiny. The headline numbers on x402 look enormous, over 150 million transactions, until independent analysts filtered out self-dealing and found genuine volume of roughly 28,000 dollars a day. That is not a typo, and it is seven orders of magnitude below the keynote slides. If you came for "agents are already an economy," this essay cannot help you.

Standards, though, do not wait for volume. They congeal early, in exactly the window when the numbers look laughable, and this window has been unusually fast. In roughly eighteen months the protocol layer got substantially decided. Google shipped a mandate protocol whose signed credentials read like machine-readable powers of attorney. OpenAI and Stripe built agent checkout, then pulled their flagship deployment when conversion disappointed. The card networks shipped agent tokens and trusted-agent registries, and ran the first live bank-issued agent payments in Singapore, Hong Kong and Europe. x402 took the machine-to-machine settlement niche and moved under neutral governance with forty member organisations. Banks appear in that list as pilot participants. Not as authors.

One layer remains genuinely open, and it happens to be the one this whole essay has been circling: agent identity and authorization. Who is this agent, who stands behind it, what may it do, and who eats the loss. The mandate protocols explicitly punt on it. Google's own documentation concedes that agent identity is out of scope. The card networks need regulated issuers in the loop for it. And it maps, almost embarrassingly well, onto what banks already do all day: identity, authority, liability, recourse.

But no single bank should build this alone, and history is blunt about why. Trust infrastructure is a network good. Agents enrol where merchants accept, and merchants accept where agents are enrolled, so a proprietary registry from one bank is a product nobody else will adopt. Every time banking has faced a problem of this shape, the answer has been a consortium utility. SWIFT: 239 banks replacing telex in 1973. CLS: built by the industry after the Herstatt collapse taught everyone what settlement risk means. Nordic BankID: banks agreeing not to compete on identity, and thereby becoming the login for an entire society. Nearly every Swedish adult uses it, billions of times a year. Visa itself began life as a consortium of banks. The pattern repeats: a shared trigger, a neutral convener, thin fees, five to ten years to critical mass, and then a position that is effectively permanent. The prize here is a registry, and the advantage goes to whoever convenes it. That race is still open. It will not stay open long.

How it actually arrives

Not with negotiating cars, is the short answer. The famous thought experiment, two autonomous vehicles paying each other for road space, sits in the final phase of this transition, if regulators ever permit it at all. The sequence in front of us is duller and closer.

Phase one is now: agents assisting human commerce, with the human still the customer of record. Phase two, over the next few years, is where the real money shows up first: corporate agent fleets. One enterprise, one compliance file, ten thousand credentialed agents drawing on sub-accounts with scoped mandates, doing procurement, treasury, logistics and compute. Unglamorous, enormous, and almost entirely a corporate-banking problem. Phase three is native machine-to-machine markets, agents buying inference, data, energy and bandwidth from one another at high frequency. The cars, if they come, come last.

Two forces will shape the timeline. The first is regulatory arbitrage at machine speed. Incorporation is becoming an API call, and agents will acquire flags of convenience the way ships did. There will be an agent Panama, and there will be FATF-style pressure on agent havens, a dynamic South Africans understand better than most.

The second force is the one I would bet on. The compliance fortress we live in was never built proactively. It was built in the ashes of named disasters. Herstatt's collapse in 1974 gave us the FX settlement utility. September 11 gave anti-money-laundering law its modern teeth. Somewhere ahead of us is the first machine-speed financial crime, a laundering mesh or a heist that moves through ten thousand agents in the time it takes a compliance officer to unlock a screen, and it will do for Know Your Agent what those disasters did for their eras. On that day regulators will not design a framework from scratch. They will reach for whichever one is lying around, ready. The institutions holding it will write the rules.

Where I land

Strip the essay to four sentences. For the first time in economic history, transaction volume is decoupling from human population and re-coupling to compute and energy. Most of the resulting explosion never touches a settlement rail, because it gets netted away, which means the durable prize is the trust, clearing and credit layer underneath, and that layer is unclaimed. Agents cannot be jailed, but neither could corporations, and the same solution works twice: register, bond, insure, rate, revoke. The adoption mechanism is already priced in, because KYC was imposed by law and KYA will be imposed by price.

I will resist the temptation to end on infinity. Sized honestly, the bank-side opportunity looks like tens of billions of dollars a year by 2030 and low hundreds of billions by 2035. Real money, and a re-partition of existing banking economics rather than a new universe. Whoever owns the trust layer takes a disproportionate share of it, plus something harder to model: the underwriting data of the machine economy.

Full disclosure, since this is the point where you should check my incentives: I am building in this layer. My company's product, Ledgerbrain, ships compliance infrastructure for agentic payments, including a Know-Your-Agent API we released recently. Please check it out – we are generous with credits for early clients.

You still can't jail an agent. It turns out you never needed to.