MetaComp released a private framework to govern AI agents in financial services. We look at what it proposes, what it leaves open and what a compliance officer in Latin America and the Caribbean can do today while there is no rule.
Until recently, the core compliance question was who stands behind an account. AI agents add a new one: who stands behind a decision that no person made? An agent that initiates a payment, prioritizes alerts or completes a customer file acts on behalf of the institution, yet it fits neither the controls designed for employees nor those designed for traditional systems.
Against that backdrop, Singapore-based MetaComp unveiled its StableX "Know Your Agent" (KYA) framework on April 21, 2026. It deserves a careful read, and some distance: it is a document published by a private company, not a rule or a standard approved by a regulator, and the claim that it is the first of its kind worldwide is the company's own.
What the framework proposes, in four ideas
According to MetaComp's press release, the framework rests on four pillars:
- Agent identity and registration. Each agent is tied to a verified person or institution and recorded in a tamper-resistant registry.
- Authority and permissions. It defines what each agent may access, decide and execute, and actions above set thresholds require a human's approval.
- Behavior and risk monitoring. Agent activity is monitored continuously and its risk profile is updated based on what it does and how it does it.
- Governance of agent-to-agent interaction. It proposes extending the logic of the FATF Travel Rule to transactions between agents, with exchange of identity and transaction information and an end-to-end audit trail.
The company adds that the framework is open to other institutions and regulators, and that it does not present it as a finished answer.
Why it matters now
AI agents no longer just answer questions: some initiate payments, query databases and propose decisions about customers. Alpha Ladder Group's chief compliance officer put it this way at the launch: "Today's compliance frameworks were designed for a world where humans initiate transactions."
That creates a concrete gap. Know-your-customer, segregation-of-duties and record-keeping policies assume an identifiable human owner. When an agent acts, you must be able to say who authorized it, within which limits, and how to reconstruct what it did.
Regulators are starting to move, though with guidance rather than obligations. In January 2026, Singapore's Infocomm Media Development Authority (IMDA) published a model governance framework for agentic AI that calls for bounding agents' autonomy, setting human approval checkpoints and applying technical controls across their lifecycle. Meanwhile, the Travel Rule is still being rolled out: in June 2025, the FATF reported that 99 jurisdictions had passed or were in the process of passing legislation to implement it. If the rule is not yet settled between people, extending it to agents is, for now, a proposal.
A practical checklist for your institution
With or without an external framework, a compliance officer can start here:
- Inventory. List every AI agent and AI-driven automation operating in the institution, including those embedded in vendor tools: what they do, on which data and in which processes.
- An owner for each agent. Assign a named business owner and technical lead to each one, just as you would for a privileged user.
- Least privilege. Document what each agent may read, propose and execute, with limits by amount, transaction type and customer.
- Action logs. Require complete, tamper-proof logs of what the agent does, with date, data used and outcome, kept for the same period as the rest of your AML records.
- Escalation to a person. Define when a decision must go to human review: high-risk alerts, unusual transactions, sanctions list matches and any suspicious transaction report.
- Vendor requirements. Contractually require model documentation, access controls, activity logging, bias and error testing, change notification and audit rights.
- An examination file. Keep the inventory, each agent's risk assessment, its testing and the approving committee's decisions in one place.
Limits and open questions
The KYA framework describes principles, but the press release gives no technical specifications or exclusions, and there is no independent assessment of how it works. Its stated scope is also the agents operating on the company's own network.
Nor does it settle the key issue for a regulated institution: accountability. No agent registry transfers the due diligence obligation or the authorship of a report to a third party; the institution remains answerable to its supervisor.
As of this writing, we have not identified rules in Latin America and the Caribbean that specifically address AI agents in AML. Until they arrive, the prudent course is to treat each agent as a high-risk outsourced process: apply existing rules on technology risk, outsourcing and record retention, document decisions, and consult your supervisor before automating sensitive tasks.
At Global KYC & Compliance Solutions, we help regulated institutions adopt automation with controls that hold up under examination.