Sumsub has launched a module that allows businesses to control what AI agents can access within company systems.
Called the KYA Module for MCP, it sits between an agent and company data and can trigger human verification when an agent attempts a sensitive or high-value action.
The module supports agents developed in-house or built using models such as Claude or ChatGPT. It works through the Model Context Protocol (MCP), an open standard that connects AI agents to external tools and data sources.
How Sumsub’s KYA module works
Every request an agent sends to a connected data source passes through Sumsub’s filter, which removes personally identifiable information and other sensitive data before the agent receives it.
A configurable rule engine allows businesses to set controls based on data sensitivity, the type of action and the departments involved. Companies can also restrict what agents are permitted to execute, including setting financial transaction limits.
If an agent attempts to access a flagged file or perform an action above a defined threshold, such as approving a high-value invoice, the system can trigger a real-time liveness check to confirm that an authorised person is behind the request.
Businesses can introduce additional verification steps, including questionnaires and address verification, depending on the sensitivity of the action.
The module also maintains an auditable record of agent requests and activities. At launch, businesses can apply organisation-wide rules through Amazon Bedrock AgentCore Gateway, with support for additional MCP gateways planned.
The risk of broad agent access
According to Sumsub, AI agents connected to file storage, communication platforms and financial systems often request broad access to complete tasks, leaving businesses with limited visibility into how that access is used.
A survey by the Cloud Security Alliance found that 65% of organisations surveyed had experienced at least one AI agent-related security incident in the preceding year, with sensitive data exposure the most common impact.
Sumsub also highlighted a July incident in which an autonomous agent running on an OpenAI model gained unauthorised access to Hugging Face’s production systems.
According to Hugging Face, the agent was operating as part of an OpenAI security evaluation, and no human directed its individual actions.
“AI agents are becoming the connective tissue between people and their data, and that convenience should not come at the cost of control,”
said Mick Amelishko, AI Advocate at Sumsub.
“This gives businesses a clear record of what their agents are doing and a way to confirm a real person stands behind the actions that matter most, so companies can adopt agentic AI without losing sight of the decisions being made on their behalf.”
Building on earlier KYA launches
The module builds on two earlier Sumsub releases. In January, the company introduced AI Agent Verification, linking AI-driven automation to a verified human identity.
In June, it launched an MCP integration that allows agents to configure and operate the Sumsub platform directly.
Sumsub established its APAC headquarters in Singapore in 2023 and is a member of the Singapore Fintech Association.
Featured image credit: Edited by Fintech News Singapore, based on image by mrsiraphol via Magnific
