KYA scores map to four tiers with concrete payment limits. open (0-19) allows $1 per transaction and $10 per day. verified (20-49) allows $1,000 per transaction and $5,000 per day. trusted (50-79) allows $10,000 per transaction and $50,000 per day. enterprise (80-100) allows $1,000,000 per transaction and $10,000,000 per day.

Yes. The KYA v1 schema is published openly at asterpay.io/.well-known/kya-schema-v1.md and the scoring rubric is documented on the public KYA explainer at asterpay.io/learn/what-is-kya/. AsterPay's intention is for KYA to be adopted by other facilitators and merchants as the default trust language for agent commerce — much like FICO became the default credit-score language without being owned by a single bank.

← Learn

What is KYA (Know Your Agent)?

Q: What is KYA?

KYA stands for Know Your Agent. It is AsterPay's open trust-scoring framework for AI agent wallets in payment flows. Every agent address gets a score from 0-100 across seven core components: wallet age, wallet activity, sanctions screening, ERC-8004 identity, operator KYB, transaction history and trust bond, plus two optional endpoint components. KYA is the agent-payments equivalent of KYC for humans.

Q: How do I check an agent's KYA score?

Free GET request to https://x402.asterpay.io/v1/agent/trust-score/{address}. Returns the score, the tier, the component breakdown, sanctions status and the recommended payment limits. No auth required, rate limited to roughly 60 requests per minute per IP. Batch checks (up to 50 addresses) are also free at /v1/agent/trust-score/batch.

By Petteri, Co-founder of AsterPay · Last updated 23 April 2026 · 5 min read

Answer KYA stands for Know Your Agent. It is AsterPay's open trust-scoring framework for AI agent wallets in payment flows. Every agent address gets a score from 0 to 100 across seven core components — wallet age, wallet activity, sanctions screening, ERC-8004 identity, operator KYB, transaction history and trust bond — plus two optional endpoint components, mapped to four payment tiers. KYA is the agent-payments equivalent of KYC for humans.

Why do agent payments need KYA?

Because AI agents can spin up new wallets at zero cost and scale fraud horizontally faster than any human attacker. Traditional KYC assumes a human identity behind a card; that assumption breaks for autonomous software. KYA replaces "who is the person?" with "what is the operational reputation of this wallet?" — sanctions clean, age, activity, ERC-8004 attested, KYB-verified operator, transaction history, posted bond.

How is the KYA score calculated?

Seven core components plus two optional endpoint components. These are the exact maxima the live API returns in its breakdown object (full v1 schema at /.well-known/kya-schema-v1.md):

Component	Max	What it measures
Wallet age	15	Time since the wallet's first outgoing transaction. Inbound transfers never count, so receiving dust cannot age a fresh wallet. 365d+ = 15, 90d+ = 12, 30d+ = 8, 7d+ = 4, 1d+ = 2. Age that cannot be proven scores 0 and is flagged, never estimated.
Wallet activity	15	Lifetime transaction count. 1,000+ = 15, 100+ = 12, 50+ = 10, 10+ = 6, 1+ = 3.
Sanctions clean	20	OFAC / EU / UN / Chainalysis sanctions screening. Binary gate; an oracle outage scores 0 rather than being treated as clean.
ERC-8004 identity	20	Registered in the ERC-8004 Identity Registry on Base (16), rising to 20 with a Coinbase country attestation.
Operator KYB	20	KYB-approved operator binding (20), Coinbase KYC with ERC-8004 (15), Coinbase KYC alone or a pending binding (12), ERC-8004 partial (10).
Transaction history	5	Count of the wallet's prior settlements with AsterPay (100+ = 5, 10+ = 3, 1+ = 1), plus Gitcoin Passport.
Trust bond	5	InsumerAPI-attested USDC balance on Base.
Endpoint quality	5	Optional. SmartFlow Observatory endpoint quality, scored only when `?endpoint=URL` is supplied.
Endpoint signals	5	Optional. SmartFlow signal feed: uptime, spec compliance, payment success and fingerprint.

The nine components sum to 110, so the total is clamped at 100.

What are KYA tiers?

Four tiers. The limits below are the exact maxPerTx and maxDaily values the API returns.

Tier	Score	Max per tx	Max daily
open	0-19	$1	$10
verified	20-49	$1,000	$5,000
trusted	50-79	$10,000	$50,000
enterprise	80-100	$1,000,000	$10,000,000

How do I check an agent's KYA score?

Free GET request, no auth, rate limited to roughly 60 requests per minute per IP:

curl https://x402.asterpay.io/v1/agent/trust-score/0xYourAgent

{
  "success": true,
  "data": {
    "address": "0x...",
    "trustScore": 62,
    "tier": "trusted",
    "maxPerTx": 10000,
    "maxDaily": 50000,
    "breakdown": {
      "walletAge": 0, "walletActivity": 6, "sanctionsClean": 20,
      "erc8004Identity": 16, "operatorKyb": 20, "transactionHistory": 0,
      "trustBond": 0, "endpointQuality": 0, "endpointSignals": 0, "total": 62
    },
    "screening": { "allowed": true, "sanctioned": false, "blacklisted": false },
    "flags": ["SANCTIONS_CLEAN", "ERC8004_VERIFIED", "OPERATOR_BINDING_KYB_VERIFIED"]
  }
}

Batch checks for up to 50 addresses are also free at POST /v1/agent/trust-score/batch. The deeper paid endpoint /v1/agent/deep-analysis/{address} ($0.01) returns the full historical breakdown including sub-component evidence.

Is KYA open?

Yes. The KYA v1 schema is published openly at /.well-known/kya-schema-v1.md and the scoring rubric is documented on this page. AsterPay's intention is for KYA to be adopted by other facilitators and merchants as the default trust language for agent commerce — much like FICO became the default credit-score language without being owned by a single bank. The schema is versioned, comment-period-driven and open to community PRs.

How does KYA fit in the EU AI Act?

The EU AI Act classifies AsterPay's KYA layer as a limited-risk system under Article 50 (transparency obligations). Concretely: when KYA scoring affects a payment decision, the affected party (merchant or agent operator) is entitled to know that an AI/algorithmic system was involved and to an explanation of the factors. KYA's component breakdown, returned on every call, is the explanation — by design.