Your browser gets you to a page. Norton Neo gets you to the answer. The first safe AI-native browser built by Norton moves with you from idea to action without slowing you down. Magic Box understands your intent before you finish typing. AI that works inside your flow, not beside it. No prompting. No copy-pasting. No switching apps.

Built-in AI, instantly and for free. Privacy handled by Norton. Built-in VPN and ad blocking protect you by default. No configuration. No extra apps. Nothing to think about.

Fast. Safe. Intelligent. That's Neo.

Download Norton Neo

There is something almost ironic about where we find ourselves in the spring of 2026.

Financial institutions have spent decades — and billions of dollars — perfecting the art of knowing their customers. We built entire regulatory ecosystems around it. Know Your Customer, or KYC, became one of the most heavily resourced compliance disciplines in the industry. Anti-money laundering programs, beneficial ownership registries, customer due diligence frameworks, ongoing monitoring obligations — all of it designed to answer one foundational question before anything of consequence happens: Who, exactly, is on the other side of this relationship?

We are now deploying AI agents across those same institutions at extraordinary speed, and we are not asking that question about them at all.

That is the problem we want to talk about today. Not the theoretical, someday-it-might-matter kind of problem. The right-now, already-in-production, regulators-are-waking-up kind.

First, Let's Make Sure We're Speaking the Same Language

Before we go further, it's worth defining what we actually mean, because the terminology in this space gets loose fast.

KYC — Know Your Customer — is the regulatory obligation that requires financial institutions to verify clients' identities before establishing a business relationship and to monitor those relationships on an ongoing basis. The goal is straightforward: you should know who you're doing business with, whether they are who they claim to be, and whether that relationship poses any legal, financial, or reputational risk to you. In the United States, FinCEN's Customer Due Diligence Final Rule (31 CFR Part 1010) sets the governing framework, built around four pillars: customer identification, beneficial ownership, understanding the nature of the relationship, and ongoing monitoring.

AI agents are something different from the AI tools most people encountered a couple of years ago. The chatbots and early generative models were essentially reactive — you asked, they answered, you decided what to do with it. An AI agent is active. It can reason across multi-step tasks, call external services, read and write data, trigger workflows, and delegate subtasks to other agents, all without waiting for a human to approve each step. JPMorgan Chase has described this shift plainly in its own public commentary: earlier AI systems informed decisions; agents make decisions on our behalf. That is not a subtle distinction. That is a categorical change in how work gets done.

Non-human identity is the emerging governance concept that sits at the center of all this. Traditional identity and access management — the systems your IT and security teams run — were designed for people. An employee gets credentials tied to their name and role, and when something goes wrong, you can trace it back to a person. AI agents don't fit cleanly into that model. They're not people, but they're also not static software with predictable behavior. They adapt. They operate continuously. They chain actions across organizational boundaries. And right now, most enterprises are treating them like service accounts or assigning them credentials borrowed from a human user's profile, which means when something goes wrong, attribution collapses entirely.

Now let's talk about why this matters in practice.