As AI capabilities increase, calls for know-your-customer (KYC) requirements to be imposed on actors across the AI tech stack will become more frequent due to concerns about bad actors leveraging AI for nefarious ends. Such proposals ought to be met with a significant degree of skepticism.
Though KYC mandates may make sense in limited domains, such as granting an actor early access to state-of-the-art systems for deployment in critical areas, broader obligations will introduce a bevy of potential negative outcomes, including hindering speech, quashing innovation, and introducing privacy risks.
At a high level, the logic behind KYC requirements is as follows:
Americans are generally free to engage in commercial transactions, with recordkeeping left to the discretion of the company and the customer.
Specific classes of transactions introduce heightened risk of illegal activity.
Alternative mechanisms for addressing those risks are unavailable or inadequate.
Reduction of that risk requires knowing more about the customer to enable timely detection and enforcement.
It is possible to precisely detect when any such individual engages in that class of transactions.
Detection mechanisms will not collect unnecessary information, or, to the extent such extraneous information is collected, will not misuse it.
Detection of illegal transactions will lead to enforcement.
Enforcement will advance the common interest.
The problem is that those premises do not hold up in the contexts in which AI KYC requirements may be introduced. A hypothetical helps make that clear.
Imagine that Company X seeks an enterprise agreement with Lab Y. Pursuant to a KYC obligation that labs track all transactions with and monitor customers engaged in cyber-related activity, Lab Y seeks granular information from Company X, such as the total number of accounts sought, what percentage of those accounts will be used for cyber tasks, and a general description of those tasks. Moreover, Company X’s logs will be maintained for at least 30 days.
On premise (2), it’s unclear how regulators and labs would separate cyber-related work that qualifies as especially risky from the routine kind. Given the current level of widespread fear around AI hacks and rogue AI agents, it seems likely that the government would err on the side of KYC mandates for customers dabbling in fairly run-of-the-mill cyber work. This may have the perverse effect of causing innovators to avoid “cyber plays” in the AI space. The upshot will be a reduction in the number of stakeholders studying novel means to ensure the redundancy and resilience required by a healthy cyber ecosystem. Rather than be subject to heightened oversight, they may prefer to apply their entrepreneurial energy elsewhere.
On premise (3), there are manifold ways to reduce illegal activity in the cyber domain short of KYC requirements. The first is to increase penalties for qualifying crimes. The second is to bolster enforcement capabilities by investing in existing agencies and upgrading existing tools. The third is to support cybersecurity best practices such that the harms introduced by illegal cyber activity may be less severe and less widespread. It’s likely that all of these approaches will be required to achieve the risk reduction desired by those who may think KYC requirements are necessary.
The key is to test them before moving to the more extreme intervention. As of now, no such rigorous policy experiment across these domains has taken place. Discrete instances of raising fines, augmenting the resources available to enforcers, and related efforts have not been evaluated to the extent necessary to justify a jump to KYC.
On premise (4), the theory underpinning KYC is that detailed information is necessary to lead to timely and meaningful enforcement. In the context of the Bank Secrecy Act (BSA), for example, banks must report every transaction in currency of more than $10,000. Before completing such a transaction, a bank must verify and record the name and address of the individual presenting it, as well as the identity, account number, and Social Security or taxpayer identification number of anyone on whose behalf it is made. Even the number on the driver’s license or passport used to verify identity goes on the report. And familiarity with a customer does not confer any privacy-protecting exemption: a bank cannot skip the paperwork for a decades-long client by simply noting that the depositor is a “known customer.”
Yet, despite all this information being gathered, there’s little to suggest the law has been effective. To its credit, Congress has attempted to rein in the law’s reach. In 1994, it directed the Treasury to cut currency transaction reports by at least 30 percent and to strip the form of information with “little or no value for law enforcement purposes.” In 2001, it found that the volume of reports was “once again interfering with effective law enforcement.” In 2020, it ordered Treasury to revisit the $10,000 threshold and required the attorney general to report annually on how often the data yields actionable information. To Congress’s discredit, those efforts have failed. Consider that in a single year, as documented by Cato’s Nick Anthony, this regime led to $59 billion in compliance costs, generating 28 million reports on their customers, and only producing 275 investigations by the IRS.
A similar set of unintended, significant consequences will follow from poorly drawn lines in the KYC for AI domain. Returning to the hypothetical, “cyber-related activity” offers no bright lines. Penetration testing, vulnerability research, and routine patch management could all qualify, and labs exposed to penalties for missing a risky customer would rationally flag every borderline case. The likely result is a bigger pile of reports, each less useful than a bank’s, landing on enforcers with no demonstrated capacity to sift through them.
On premise (5), regulators will find it difficult to draw the line between a collected activity that is innocuous and one that deserves investigation. Imagine two users: one a member of a red-teaming effort to identify vulnerabilities on behalf of a rural hospital system, and another who’s part of a ransomware crew. Now, picture them both entering the same prompt—an attempt to map the network’s exposed services. They are indistinguishable absent more information about the users themselves. If labs attempted to glean that information through voluntary means or self-disclosure, then they can expect honest firms to reveal the full truth and nothing but the truth, and bad actors to pretend to do the same. In short, sooner or later, bad actors will systematically find ways to bypass those checks.
An example from the banking context evidences this inevitability. Because cash over $10,000 triggers a BSA report, individuals intent on avoiding detection have predictably opted to break deposits into smaller sums that slip under the threshold—a tactic known as structuring. Congress attempted to develop yet another responsive fix—it is now a federal crime to structure transactions for the purpose of dodging detection. But it’s a cat-and-mouse game, and it’s unclear when the chase is no longer worth the effort. In AI, the equivalent workaround—spreading tasks across accounts, providers, or open-weight models run on one’s own hardware—is cheaper still and far harder to spot. In short, it’s likely that any KYC regime in AI will filter for candor, more so than criminality.
On premise (6), what Lab Y collects is hardly incidental. Descriptions of Company X’s cyber tasks may expose its product roadmap or its clients’ unpatched vulnerabilities. Aggregated across thousands of customers, those logs become a honeypot: a single, searchable map of which firms are probing which systems and where the weak points lie. A breach or a rogue insider at the lab would hand attackers a ready-made target list—one that exists only because the law required it to be compiled. That exposure may only grow worse over time absent specific limits on data collection and storage. The Bank Secrecy Act requires covered records to be kept for five years, and regulators who find AI logs useful may well push retention toward that benchmark. Finally, the logs themselves chill inquiry. Security researchers, academics, and journalists routinely ask models how exploits work so they can defend against them. If they know those queries are being cataloged for possible government review, many will stop asking—or migrate to foreign and open-weight tools that no US lab can see.
On premises (7) and (8), detection does not necessarily result in enforcement, and enforcement may not always align with the public benefit. Substantial resources may be squandered in efforts to find and punish foreign actors in jurisdictions where a U.S. subpoena carries little weight. As it stands, the agencies likely to be involved with enforcement here are already short on funds and personnel. They may opt to avoid the most difficult cases and instead zero in on startups, which often bear a disproportionately high compliance burden relative to their larger competitors. This may ultimately result in a moat for the incumbent AI companies or drive users to open-weight models, which present a unique set of risks and benefits. Recognition of these enforcement hurdles can induce a troubling expansion of enforcement authority. The bank-reporting statute lets the Treasury designate institutions as an “agent of the United States Government,” for example. Broad AI KYC may quietly deputize labs the same way.
None of these findings close the door on KYC as an appropriate approach to some AI governance questions. For example, it may be a particularly compelling intervention when a lab grants a small set of partners early access to its most capable systems—in such instances, knowing exactly who sits on the other end is a sensible, less restrictive alternative to government dictating such access.
Outside that narrow lane, proponents should have to show their work to justify a KYC mandate: test the alternatives first, define covered activity with real precision, cap retention, and pair any mandate with a sunset clause and a meaningful duty to report whether the data actually led to enforcement. Otherwise, as seen in the financial sector, such policies can not only fail to achieve their purpose but raise serious additional concerns. Most AI use is, frankly, boring. Treating every cyber customer like a suspected money launderer or potential bad actor would leave the nation less innovative, less private, and no safer.
