Agentic Commerce Is Forcing a Shift From "Know Your Customer" to "Know Your Human"
Payments infrastructure was built around one assumption: a human is on the other end of the transaction. Agentic commerce breaks that assumption, and the industry response has a name now: moving from KYC ("know your customer") to KYA ("know your agent"), with the harder underlying problem being "know your human" — proving there's a real, accountable person behind the agent that's spending money on their behalf.
Why this is happening now
As more purchasing, booking, and account actions get delegated to AI agents, payments firms have to answer a question that didn't used to need answering: when an agent completes a transaction, who is actually authorizing it, and can that be proven after the fact? Traditional KYC verifies a human identity once, at account creation. It says nothing about whether the specific action an agent just took, three months later, at 2am, was actually something that human wanted.
The reporting on this shift includes a number worth sitting with: "good enough" identity systems, the kind most businesses currently run, are already costing companies an estimated 3.1% of revenue. That's not a hypothetical future risk. It's the current price of ambiguous accountability, spread across fraud, disputes, and the operational cost of untangling "did the agent actually have authority to do that."
The infrastructure response
This isn't a fringe concern. Visa and Mastercard have both moved on it directly: Visa's Trusted Agent Protocol and Mastercard's Verifiable Intent are both attempts to build a trust layer that lets a merchant or payments processor confirm an agent's action was actually authorized by the human it claims to represent, before the transaction settles. Identity infrastructure players like Persona and Entrust are building adjacent "know your agent" verification products aimed at the same gap.
The card networks moving in parallel, within months of each other, on the same problem is a market-forming signal, not a niche security patch.
What this means for SMBs, not just enterprise merchants
Enterprise-tier agent identity infrastructure is being built for large merchants and payment processors first. That leaves a widening gap underneath it: SMBs who are already letting agents book, order, or transact on their behalf, or who are building agent-facing storefronts themselves, without any equivalent verification layer, and without Visa or Mastercard-scale integration budgets.
That 3.1% revenue cost isn't reserved for large enterprises. Any business accepting agent-initiated actions, bookings, orders, account changes, without a way to verify the human behind the agent is exposed to the same ambiguity, just without the infrastructure to quantify or contain it.
What SMBs should actually do
1. Don't wait for card-network-scale infrastructure to trickle down. The enterprise trust layer (Visa/Mastercard/Entrust) is built for large-scale integration timelines. SMBs need an accessible equivalent now, not in eighteen months. 2. Tie every agent-initiated action back to a verified human, not just a verified account. An API key or login session proves the agent has access; it doesn't prove the human behind it authorized this specific action. 3. Build the audit trail before the dispute, not during it. When a customer or supplier disputes an agent-initiated transaction, "our agent had valid credentials" is not an answer. "Here's the verified authorization chain for this specific action" is.
This is exactly the accessible, SMB-scale version of what Visa and Mastercard are building for enterprise merchants — verified agent identity and an auditable authorization trail, without needing card-network integration budgets.
The bottom line
The card networks agree the "know your agent" gap is real enough to build new infrastructure for it. The 3.1% revenue cost of getting it wrong doesn't check company size before it applies. SMBs letting agents transact on their behalf need an answer to "was this human actually behind this action" now, not whenever enterprise infrastructure finishes trickling down.
See how Attest gives your business verified, auditable AI agent identity — the accessible version of the trust layer Visa and Mastercard are building for enterprise agentic commerce.