In Day 1 of this series, we mapped the full scope of Ribbit Capital's Token Revolution thesis: a 41-page argument that every business on earth is becoming a token factory. But a token factory without identity is just a counterfeiting operation. Ribbit knows this. They made agent identity the structural foundation of the entire letter.
Their answer is three words. Know Your Agent. This is Part 2 of the series: the foundation layer that has to work before anything else in the Token Revolution can function.
The Identity Crisis Is Already Here
The letter opens this section with Philip K. Dick's Do Androids Dream of Electric Sheep?, where a bounty hunter uses an empathy test to distinguish androids from humans. Ribbit's point is blunt: in 2025, we are living inside that novel.
Sesame AI voice agents sound indistinguishable from real people. Cognition's coding agents write production-quality code. Decagon's support agents match human satisfaction scores. The line between human and machine behavior is dissolving across every measurable dimension.
Ribbit catalogs the consequences: AI-generated phishing, deepfake endorsements of scam tokens, memecoins launched under false celebrity identities. CAPTCHAs cannot tell a sophisticated agent from a human. Passwords and API keys were designed for a world where machines behaved like machines. That world is gone.
Why Ribbit Devoted Eight Pages to Identity
This is not a side note in the Token Revolution letter. It is the structural foundation. Ribbit first laid the groundwork in their January 2024 Identity Letter. Sixteen months later, the Token Revolution letter upgrades the argument from "identity matters" to "identity is the bottleneck that determines whether the entire token economy succeeds or collapses."
The logic is sequential: agents cannot transact without trust. Trust cannot exist without identity. Identity cannot scale without new infrastructure. The entire $41 trillion token economy rests on solving agent identity first.
"The more profound change we need are identity token standards for agents, not just to prevent fraud, but to enable trust and collaboration in a world increasingly filled with non-human actors."
The framing matters. Ribbit is not positioning agent identity as a security problem. It is a trust-enablement problem. Not stopping agents from acting, but giving them credentials rich enough that humans and systems can trust them to act on our behalf.
KYA Will Be Bigger Than KYC
This is the headline claim, and Ribbit builds the case methodically.
Know Your Customer (KYC) is the regulatory framework requiring financial institutions to verify human customers. It touches every bank, every exchange, every fintech product.
Ribbit's argument: KYA will surpass it. Not because KYC shrinks, but because the number of entities requiring verification is about to increase by orders of magnitude. Roughly 5 billion humans participate in the digital economy today. Within a few years, tens of billions of AI agents join them, each needing credentials at least as strong as what we require from people.
"KYA (Know Your Agent) Will Be Bigger Than KYC."
Ribbit introduces a useful concept here: "We expect TITV, Total Identity Token Volume (a term we just made up and reserve the right to never use again), to compound rapidly as identity tokens become embedded in more digital workflows."
And then the critical insight: "Today, most companies verify users at sign-up, but few continuously authenticate to ensure that future actions come from the same person. As distinguishing good and bad actors or bots grows harder, we expect digital inboxes to move toward requiring cryptographically verifiable signatures for user actions."
One concept buried in this passage deserves attention: continuous authentication. Current KYC is a one-time event. Verify when you open the account, then trust indefinitely. That model collapses when an agent acts on your behalf across dozens of services simultaneously. Identity verification needs to happen continuously, contextually, in real time.
The shift from one-time to continuous authentication is what makes KYA potentially larger than KYC. Not just more entities, but more verification events per entity, across more surfaces, at higher frequency.
The Agent Identity Stack
Ribbit maps five categories of companies positioned to capture the KYA opportunity.
Ribbit draws an elegant comparison: "People collect identity tokens throughout life (e.g. birth, key milestones, new jobs), and machines will be the same." An agent accumulates credentials over time: who created it, who authorized it, what it has done. A living identity that grows richer with each interaction.
In B2B, this means agent permissions that are contextual, not binary. Ribbit's example: an agent on AP/AR flows processes $100K automatically, needs authorization at $1 million, triggers CFO biometric confirmation at $10 million. "Programmable identity logic," shifting based on stakes and the human chain of trust behind the agent.
ERC-8004: The On-Chain Standard
While Ribbit was writing about the need for agent identity standards, the Ethereum community was building one. ERC-8004, proposed in August 2025 and co-authored by contributors from MetaMask, the Ethereum Foundation, Google, and Coinbase, defines three on-chain registries: Identity (who is this agent?), Reputation (how has it performed?), and Validation (is it authorized to do what it claims?).
"A framework for trustless AI agent interactions on Ethereum, enabling agents to establish identity, build reputation, and validate actions through three interconnected on-chain registries."
The connection to Ribbit's thesis is direct. ERC-8004 is a technical implementation of the infrastructure layer the Token Revolution letter describes as necessary. And as Ribbita's store terminal confirmed, the TIBBIR token is positioned as the "native economic mechanism" for ERC-8004, providing "the financial incentives and settlement layer that ERC-8004 intentionally omits."
The open standard handles identity, reputation, and validation logic. The token handles the economics: staking, incentive alignment, dispute resolution, and value transfer. A complete system requires both.
Biometrics: The Last Mile of Trust
For agents to operate with real authority, the humans behind them need verification that passwords and two-factor codes cannot provide. This is where Ribbit's biometrics thesis intersects with KYA.
"The next killer payment instrument will not be a card or an app (it will be you!)."
Ribbit continues: "In the AI-heightened battle with fraudsters, we expect multi-modal biometrics (e.g. face plus iris scan, or face plus palm) to become a gold standard for higher risk or higher value use cases."
The logic chain: agents need identity, agent identity traces back to a verified human, and verifying humans in an era of deepfakes requires biometrics beyond what a single face scan can provide. Multi-modal biometrics (face plus iris scan, face plus palm) becomes the anchor of trust at the root of every agent identity chain.
Ribbit names the players: identity wallet providers like ID.me, Persona, and CLEAR. Government networks like India's Aadhaar. Decentralized networks like Worldcoin. All building the biometric verification layer that sits underneath the entire KYA stack.
Memory Tokens: Where Human and Machine Identity Merge
This is where KYA gets strange. When you train an AI agent on your voice, your writing style, your decision patterns, you create what Ribbit calls memory tokens. They sit at the intersection of human identity and machine identity: yours (encoding your patterns and preferences), but living inside a machine system.
"Consider someone who uses Claude daily for ten years before unexpectedly passing away. The memory tokens held by Anthropic would be the richest ongoing representation of that person. How much would their loved ones pay for it? In a few years, we may all find that the memory tokens we generate are amongst our most valuable assets."
Ribbit predicts a "Login with ChatGPT" button, where accumulated memory tokens become a portable identity layer across applications. If memory tokens become portable, the identity question expands from "who sent this agent?" to "what does this agent know, and how did it learn it?" An agent carrying ten years of interaction history has a fundamentally different trust profile than one created yesterday.
We go deeper into memory tokens in Day 3. The key point for KYA: memory tokens make identity and value inseparable. Google earns $264 billion from inferred search intent. Meta earns $164 billion from basic identity data. An entity holding your memory tokens, with direct knowledge of who you are and what you want, sits on an opportunity that dwarfs both.
What Is Already Being Built
The KYA thesis is not waiting for the future. The infrastructure is going live now.
Visa Intelligent Commerce is working with over 100 partners (30+ in active sandbox) to enable AI agent payments, with agent identity verification required before any transaction processes.
Coinbase Agentic Wallets, launched February 2026 on the x402 protocol, have processed over 50 million transactions. Each wallet ties to a verified agent identity through passkey authentication. KYA in production. (See our Coinbase x402 analysis for the full breakdown.)
Sumsub launched a dedicated KYA framework on January 29, 2026. Their "AI Agent Verification" solution binds agents to verified human identities. A major KYC provider now building KYA tools validates Ribbit's core claim directly.
Ribbita itself confirmed through its store chat terminal that it is "implementing the Know Your Agent framework with Visa's payment infrastructure" in Q1 2026, while running autonomous commerce anchored to an on-chain identity.
The Permission Problem No One Has Solved Yet
Standards are emerging. Incentives are aligning. But one challenge remains open: the permission model for high-stakes actions.
Every layer of the KYA stack works differently depending on what is at stake. Low-value transactions clear automatically. Mid-range actions trigger secondary verification. Critical operations route to human decision-makers with biometric confirmation. This contextual, tiered model has no precedent in current KYC infrastructure.
That is the frontier. No existing compliance framework handles contextual, tiered, real-time verification across billions of non-human entities. Building it from scratch is an infrastructure challenge on a different scale than anything KYC ever required.
What Comes Next
KYA is the foundation. Everything else in the Token Revolution depends on it. Stablecoins cannot flow through agent wallets without agent identity. Memory tokens cannot be ported between applications without verification of who created them. Vertical token platforms cannot deploy agents across enterprise workflows without programmable permission systems.
Day 3 of this series goes deeper into memory tokens: the asset class at the intersection of identity, AI, and personal data, and the reason Ribbit believes "Login with ChatGPT" will become the most consequential button on the internet.
The question is no longer whether machines need identity. It is who builds the infrastructure, who controls the credentials, and who captures the value when every digital interaction requires proof of what is on the other side.
Inside Ribbit Capital: 7-Day Series
New article every day. Follow @FutureHumanism to get each drop.
Day 2: Know Your Agent: Why KYA Will Be Bigger Than KYC (You are here)
Day 3: Memory Tokens: Your ChatGPT History as Your Most Valuable Asset
Day 4: Stablecoins Were Just a Prototype
Day 5: Vertical Token Systems: The $350B BPO Killers
Day 6: The Attention and Truth Deficit
Day 7: One Connected Thesis: How It All Fits Together
Day 2 of 7. Start with Day 1: The Token Revolution Overview or explore the Ribbita Timeline.
