KYC, KYB, KYE, KYA, KYM: A Test for Telling an Obligation From a Coinage, and One Answer We Decline

Nothing here is legal advice

This page describes our own engineering state and offers a way of thinking. It is not legal advice, it states no requirement of any regulation, and nothing on it should be relied on as a description of what any jurisdiction demands of you.

Why there is no table on this page

You came for a five-row grid: acronym, meaning, who it applies to, whether it is mandatory.

We are not going to produce one, because we cannot verify the fourth column. Whether a term names a supervised obligation depends on jurisdiction, on the kind of entity you are, and on instruments we have not read and are not qualified to interpret.

A confident grid would be the easiest thing to write and the most likely thing on this surface to be wrong in a way that costs a reader money.

The test, which you can apply yourself

Four questions separate an obligation from a coinage.

One: can you name the instrument? A rule, a directive, a regulation, a supervisory expectation with a citation. If nobody can produce the text, there is no text.

Two: who supervises it? An obligation has an authority that examines entities against it.

Three: what happens when you fail? A real obligation has a consequence attached: a penalty, a licence condition, an enforcement action.

Four: who does it bind? Obligations bind defined categories of entity. A term that binds "everybody in the industry" binds nobody.

Apply those four to any of these acronyms and the answer stops being a matter of opinion.

The one we have applied it to

The agent term fails all four, which this estate measured rather than assumed: no instrument names it, no authority supervises it, no consequence attaches, and it binds no defined category.

That does not make it useless. It makes it a product category, and the honest way to use it is as shorthand for a set of capabilities somebody must then specify.

What it must not do is borrow the enforcement of an older term by rhyming with it.

And the ones we decline to score

For the customer, business, employee and merchant variants, we are not going to tell you which are supervised obligations where.

Not because it is unknowable, but because it is jurisdiction-specific and we would be guessing at the edges. Ask the four questions of your own regulator, your own counsel and your own instrument list, and you will have a better answer than any table we could publish.

A page that declines one column is more useful than a page that fills it wrongly.

What is already built, because absences alone would misdescribe us

The separation of duties holds. Identity checking happens on another surface, this one ingests the result, and our credential names the attester rather than asserting the fact.

The credential format is a published standard and the identifier method is registered in the W3C DID Method Registry, so a recipient can check an attestation without our code.

And revocation works, so a withdrawn attestation reaches a verifier who asks.

What does not change, whichever acronym you use

Our surface ingests a verification credential and never performs a check. That is true under every label in the title.

And what we hold is narrow and measured: a reference to a check performed elsewhere, an assurance level supplied by the party it describes, and no verdict from the checking party inside the credential.

So whichever acronym a requirement is written in, the question to ask us is the same: what does the artefact carry, who attested it, and can the recipient check that attestation independently.

Those three have answers on this surface. The acronym does not change them.