Sumsub Launches KYA Module to Prevent Unauthorized AI Agent Actions

Sumsub has launched its Know Your Agent (KYA) Module for MCP, a tool designed to regulate how AI agents interact with sensitive corporate data. For fintech professionals, this provides a necessary control layer for autonomous models like Claude or ChatGPT, ensuring that high-value actions remain tethered to verified human accountability within internal systems.

What was announced

On October 19, 2026, Sumsub introduced the KYA Module for MCP, an expansion of its existing Know Your Agent framework. This module acts as a specialized filtering layer between AI agents—including those built on ChatGPT or Claude—and the internal data systems they access. It is designed to solve the "broad access" problem, where agents often request wide-ranging permissions to complete tasks but leave businesses with little visibility into their actual behavior.

The system operates by screening every request an agent sends to connected data sources, stripping out personally identifiable information (PII) and other sensitive data before it reaches the model. A configurable rule engine allows businesses to set limits based on data sensitivity, department, or specific actions. For example, if an agent attempts to approve an invoice above a pre-set financial threshold or access a restricted file, the module triggers a real-time liveness check. This requires a verified human to confirm the request before it can proceed.

The release follows a period of heightened security concerns regarding autonomous agents. Research cited by Sumsub indicates that 65% of organizations experienced a security incident involving an agent in the past year. The module is currently built for the Amazon Bedrock AgentCore Gateway, with support for additional Model Context Protocol (MCP) gateways to follow. This builds on earlier milestones, including the January launch of AI Agent Verification and the June introduction of the industry’s first MCP integration.

The companies involved

Sumsub is a global provider of AI-driven compliance and verification solutions, describing its platform as the first "trust infrastructure" for compliance operations at scale. The company has become a frequent subject of industry analysis, with FF News having tracked its developments across 96 separate reports. Its product suite typically focuses on the intersection of identity verification, fraud prevention, and regulatory adherence, particularly for high-growth sectors like fintech and digital banking.

The firm’s recent strategy has focused on addressing the specific risks posed by the "agentic" AI era—where software models act autonomously on behalf of users. By positioning itself as a verification platform that enables AI agents to build their own compliance setups, Sumsub is attempting to capture a market share that extends beyond traditional customer onboarding. This involves moving into the enterprise security space, where the distinction between a human employee and an AI-driven tool is becoming increasingly blurred within corporate networks.

What FF News has reported before

FF News has closely followed Sumsub’s expansion into AI-centric security. In September 2026, the company launched Sumsub Debuts Workforce Verification to Combat AI Fraud and Secure Enterprise Systems, which laid the groundwork for securing internal enterprise environments. This followed a partnership with DashDevs, as reported in DashDevs and Sumsub Partner to Embed Automated Compliance into Fintech Core Platform, which focused on embedding compliance directly into core fintech architectures.

The company has also been vocal about the evolving fraud landscape. In late September, we covered a report where European Banks Failing to Stop Fraud at Instant Payment Speeds, Sumsub Report Finds, highlighting the pressure on traditional institutions. More recently, the firm expanded its technical capabilities by integrating external data sources, as seen in Sumsub Integrates IPinfo Intelligence to Strengthen Fraud Prevention and Regulatory Compliance.

What this means

The introduction of the KYA Module signals a shift in how the fintech industry perceives AI risk. We are moving away from a period of experimentation where models were given wide berths, toward a "verification-first" approach where every automated action must be auditable. This puts significant pressure on AI infrastructure providers to integrate security at the protocol level rather than as an afterthought.

For the broader market, this raises questions about the scalability of "human-in-the-loop" requirements. While liveness checks provide a safety net, they could potentially reintroduce the very friction that AI agents were meant to eliminate. The sector must now balance the need for absolute human accountability with the operational speed promised by autonomous systems.