Who Signs the Contract When Your AI Agent Does It?

One sentence.
When an AI agent pays a vendor, files a compliance report, or executes a smart contract — existing law does not know who is responsible.

The New Reality

Autonomous AI agents are no longer demos.

They are:

• Approving invoices and making payments
• Filing compliance reports with regulators
• Executing A2A (agent-to-agent) financial protocols
• Signing API contracts on behalf of companies

This is happening right now in production systems across fintech, legal, and professional services.

1. The Identity Gap

     TRADITIONAL TRANSACTION           AGENTIC TRANSACTION
     ─────────────────────             ───────────────────────
     Human → Verified Identity         Agent → ??? Identity
     Human → Accountable               Agent → Who is liable?
     Human → Audit trail               Agent → Was it logged?
     Human → Override possible         Agent → Who stops it?

Every financial transaction in Australia requires a verifiable identity behind it.

An AI agent has none of the above by default.

It uses the credentials of the service it runs on — which means the liability falls on the company running it, without a clear evidentiary trail showing who actually authorised the action.

2. The Three Questions AUSTRAC Will Ask

When something goes wrong with an autonomous financial transaction, regulators will ask:

1. Who authorised this agent to act? — Was there human approval before execution?
2. What did the agent do? — Is there a complete, tamper-proof log of every action?
3. Could a human have stopped it? — Was there a review gate before final execution?

Current agent stacks (LangChain, AutoGen, CrewAI, Claude Code) are powerful but do not provide these by default.

3. The Digital Assets Framework Makes It Urgent

The passage of Australia’s Corporations Amendment (Digital Assets Framework) Bill 2025 (which received Royal Assent on 8 April 2026, and commences on 9 April 2027) places crypto assets firmly under the Australian Financial Services Licence (AFSL) regulation.

That means when an AI agent:

• Executes a smart contract
• Moves funds via a crypto wallet
• Settles a tokenised asset transaction

…the agent’s action is now a regulated financial service — and the question of cryptographic identity becomes a compliance requirement, not a design choice.

4. What “Agent-KYB” Looks Like

The emerging standard for agentic financial identity has five components:

This is the “KYB for agents” — Know Your Bot.

5. The Opportunity Window

The companies that build Agent-KYB as a product — not just a whitepaper — will own the compliance layer for the next decade of autonomous AI.

The Big Takeaway

Capability without identity is just risk.
The winning strategy in regulated AI is not the fastest agent.
It is the agent with the cleanest audit trail.

Australia’s regulatory window — AUSTRAC, Digital Assets Framework, APRA’s AI guidance — has created a 12–18 month gap between what agents can do and what they are legally permitted to do without oversight.

That gap is the product.

Related reading

• MCP Tool Poisoning: The Attack Vector Nobody Is Talking About — the attack surface that makes agent identity urgent.
• I Gave an AI Agent the Keys to My Life. Here Is the Trust Architecture. — what the controls look like in practice.
• The 10-Star Experience: Why Product and Engineering Need Legendary Test Cases — designing trust and delightful assurance into agent workflows.

Written by Haris Habib from Sydney, Australia | May 2026