But findings in “Identity at Scale: Where KYC/KYB Touchpoints Create (or Contain) Agent Risk,” a new report from PYMNTS Intelligence and Trulioo, reveal how that model has increasingly collapsed under the weight of sophisticated adversarial behavior and automated bots.

The bots aren’t coming for commerce, the report found. Because they’re already there inside the system. Across everything from logins to loan applications, automated agents are now probing, mimicking and exploiting identity workflows at scale. During high-value moments like lending, over 63% of firms surveyed reported agent-driven threats and adversarial bots.

The result is forcing a rethink of digital trust: not just knowing your customer or your business, but increasingly, knowing whether you’re dealing with a human at all.

Why Identity Is Becoming a System, Not a Checkpoint

For years, bots were treated as an externality to be filtered out at the edges of digital systems. They showed up in bursts: credential stuffing attacks, fake account creation, scripted checkout abuse. Firms built defenses accordingly, focusing on detection at key entry points like login or onboarding.

But what has changed is not simply the volume of automated activity, but its distribution and persistence across the entire operational stack. Identity verification, once concentrated at onboarding, now spans multiple workflows: authentication, transactions, fraud monitoring, vendor onboarding and lending. As these controls expand, so too does the surface area for automated agents to operate within them.

The question is no longer how to block bots at the perimeter. It is how to govern a system in which non-human agents are persistent, adaptive and economically consequential.

As bots become more integrated into economic activity, a new layer of identity emerges that sits alongside traditional frameworks like know your customer (KYC) and know your business (KYB). Increasingly, firms must contend with what might be called know your agent (KYA): the ability to identify, classify and govern non-human actors.

Designing for this reality requires a different mindset. Instead of treating bots as anomalies, firms must assume their presence as a baseline condition. Systems must be built to accommodate a mix of actors, each with different characteristics, capabilities and risks.

This involves developing new forms of identity that capture not just who or what an entity is, but how it behaves over time. It means integrating signals across workflows to create a more holistic view of trust. And it requires establishing policies that define acceptable use, rather than relying solely on binary allow-or-block decisions.

Read the report: Identity at Scale: Where KYC/KYB Touchpoints Create (or Contain) Agent Risk

One of the more counterintuitive findings in the report is that the breadth of identity deployment often matters more than the sophistication of any single control. Firms that apply verification across a wider set of workflows (five or more) tend to experience less pressure from automated agents, fewer breakdowns and lower downstream costs.

When identity controls are embedded across multiple touchpoints, they reinforce one another, reducing the opportunities for agents to exploit gaps. Enforcement becomes more uniform, ownership clearer and signals more integrated.

The implication is that identity maturity is less about isolated excellence and more about systemic coherence. It is the difference between a series of checkpoints and a continuous control plane.

The challenge is not simply to keep bots out. It is to design systems that can operate effectively in their presence. In doing so, firms are not just defending against a threat. They are adapting to a new economic reality in which the question of who — or what — is on the other side of the interaction is more complex, and more consequential, than ever before.