Know Your Agent (KYA): verifying agents, mandated agents and intermediaries

In short: Know Your Agent (KYA) refers to the verification of the agents, mandated agents and intermediaries who act on behalf of a third party: distributors, brokers, introducers, mandated sales agents, authorised subcontractors. It is the blind spot of KYC (the end client) and KYB (the company): you check your client, but not always the person acting in their name. KYA verifies the agent's identity, their actual authorisation, their integrity, and traces their actions.

‍

An emerging new frontier: the autonomous software agents (agentic AI) that transact on behalf of a user or a company and that must now be authenticated.

‍

What is Know Your Agent?

‍

Know Your Agent (KYA) is the process by which an organisation verifies the identity and the legitimacy of the intermediaries who act in its name or on behalf of its clients. Where KYC focuses on the individual client and KYB on the business client, KYA focuses on a third player, often forgotten: the one who sits between you and the ultimate beneficiary of the relationship.

‍

In practice, an agent in the KYA sense can be a distributor, a broker, an introducer, a mandated sales agent, or an authorised subcontractor entitled to represent a company. They all have one thing in common: they act on behalf of a third party and can trigger the liability of the organisation that mandates them or that agrees to deal with them.

‍

The central question of KYA is simple: is this person or entity really authorised to act on behalf of the one they claim to represent? Answering it means verifying both who the agent is and the mandate that ties them to the represented third party.

‍

Why it is a blind spot of KYC and KYB

‍

Most compliance frameworks are built around two clearly identified targets: the individual client (KYC) and the business client (KYB). These two building blocks are solid, but they leave a grey area.

Take a simple example. A company takes out a financial product through a broker. The framework carefully checks the business client (KYB) and, where applicable, its beneficial owners.

‍

But the broker themselves, the one who builds the file, forwards the documents and acts as the interface, is rarely subject to the same level of scrutiny. They are assumed to be authorised. They are not always verified.

‍

This is where the blind spot arises: you verify the end client or the company, but not the intermediary acting in their name. Yet it is often this intermediary who builds the file, who transmits the bank details and who carries the relationship. If their identity, authorisation or integrity are not checked, the entire chain of trust rests on an unverified link.

‍

This blind spot is all the more risky because the company's liability can be triggered by the acts of its agent. A mandated agent who acts wrongly, even without a valid mandate, can create harm attributable to the organisation that let them act.

‍

The risks of an unverified agent

‍

Failing to verify your agents and intermediaries exposes you to a series of concrete risks, both financial and regulatory.

• Unauthorised or impersonated intermediary. A person presents themselves as a mandated agent of a company or a network without having the right to, or impersonates a genuinely authorised agent in order to capture files or payments.
• Fake mandate. The document supposed to prove the authorisation is forged, expired or never existed. The agent then acts without real power, which legally weakens the entire relationship.
• Fraudulent introducer. An introducer builds fictitious files, inflates volumes or brings in fictitious clients to collect undue commissions.
• Misappropriation of funds and fraudulent files. An agent in an intermediary position can redirect flows, substitute bank details or fabricate fraudulent files from their position of trust.
• Liability triggered. The company can find its liability triggered by the acts of its agent, including when the agent acted outside their mandate, with a reputational and regulatory impact.

‍

These risks overlap with those of identity fraud and document fraud, but with one specificity: the fraudster does not pose as the client, they pose as the one acting on behalf of the client.

‍

What KYA verifies

‍

A structured KYA framework is built around four complementary dimensions.

‍

Identity

‍

First step: verify the agent's identity, whether a natural person or a legal entity. The point is to confirm that the person or entity is indeed who they claim to be, through a suitable identity verification and fraud score, relying on the same building blocks as KYC and KYB. Without a reliable identity, no authorisation check has any value.

‍

Authorisation

‍

The core of KYA: verify the actual authorisation of the agent to act on behalf of the represented third party. This means checking the mandate (existence, validity, scope), and, where applicable, the regulatory registration. In France, for example, insurance, banking and finance intermediaries must be registered with ORIAS; this registration can and must be verified. The aim is to make sure the agent has the right to act, and within what scope.

‍

Integrity

‍

Verifying the agent's integrity means assessing their reliability: track record, warning signals, presence on sanctions lists or lists of politically exposed persons where relevant, consistency of their background. An agent authorised on paper may show signals that justify enhanced vigilance, or even a refusal.

‍

Traceability

‍

The last dimension, often overlooked: trace the agent's actions. Who built this file? Who forwarded these details? Who validated this step? Complete and auditable traceability makes it possible to reconstruct the chain of responsibilities and to detect abnormal behaviour over time. It is also what makes a decision documented and enforceable in the event of an audit.

‍

New frontier: AI agents (agentic AI)

‍

A recent development broadens the scope of KYA beyond human intermediaries. With the rise of agentic AI, autonomous software agents are beginning to act and transact on behalf of a user or a company: placing an order, initiating a payment, filling in a file, subscribing to a service.

‍

This outlook remains emerging, and it is wise to stay cautious about its real scale at this stage. But it raises a question that directly overlaps with the logic of KYA: who is really acting? When a software agent transacts, you have to be able to authenticate the agent, verify that it is indeed acting for the declared account, and trace its actions, exactly as for a human mandated agent.

‍

In other words, the need is the same as in classic KYA: making sure that the one acting on behalf of a third party is identified, authorised and traceable. KYA provides precisely the conceptual framework to address this new frontier, as it becomes clearer.

‍

How to implement KYA

‍

Implementing Know Your Agent does not mean starting from scratch. It means extending to agents and intermediaries the verification logic already applied to clients.

‍

1. Map your intermediaries. Identify all the players who act in your name or on behalf of your clients: distributors, brokers, introducers, mandated sales agents, authorised subcontractors.
2. Verify the identity of each agent at the start of the relationship, reusing your identity verification and KYB building blocks for legal entities.
3. Check the authorisation: existence and validity of the mandate, scope of action, and regulatory registration where it applies (ORIAS for insurance and finance intermediaries, for example).
4. Assess integrity through list checks and risk signals suited to your sector.
5. Trace and document every action of the agent, to have a complete and enforceable audit trail.
6. Replay the checks over time: a mandate expires, a registration can be struck off, a situation evolves. KYA is not a one-off check but continuous monitoring.

This is exactly the approach Meelo enables: extending the logic of identity verification and KYB to agents and intermediaries, for a decision in 2 to 5 seconds, documented and auditable.

‍

In conclusion

‍

Know Your Agent (KYA) fills a real blind spot: between the individual client (KYC) and the business client (KYB), there remains the intermediary who acts in their name, too often unverified. Checking the identity, authorisation, integrity and traceability of your agents, mandated agents and distributors reduces a concrete risk of fraud and liability. And as autonomous AI agents begin to transact on behalf of third parties, the question posed by KYA (who is really acting?) will only grow in importance. The good news: it is about extending to intermediaries a verification logic that you already master.

‍

Sources: ORIAS (single register of insurance, banking and finance intermediaries); French AML-CFT framework relating to due diligence on third parties and intermediaries; sector work and publications on agentic AI and the authentication of autonomous agents.

‍