Compliance-by-Cryptography: Can ZK Proofs Gate Agentic Finance?

After the CLARITY Act stalled in the Senate, U.S. regulators are shifting to administrative rulemaking. Peirce’s farewell speech put “zero-knowledge compliance” into the official record, and the identity layer for AI-agent payments is becoming the next infrastructure battleground.

U.S. digital-asset regulation is entering a rare “vacuum”: Congress has stalled, and regulators are being forced to fill the gap with administrative action. Beneath the surface, a deeper shift is underway. In her farewell speech on September 23, SEC Commissioner Hester Peirce publicly framed zero-knowledge proofs as a compliance tool rather than an evasion tool, arguing that cryptographic proofs should replace data-hoarding KYC/AML practices. This is exactly the missing piece for agentic finance: machines have no “identity,” yet they must prove they are compliant.

This week (9/23-9/28) a clear thread ran through the U.S. market: a regulatory vacuum plus an AI-agent compliance identity layer. Three seemingly unrelated stories, the stalled CLARITY Act, Peirce pushing ZK compliance, and Baselayer/Socure betting on agent identity infrastructure, all point to the same conclusion: as AI agents begin to transact autonomously, the question of “who you are” is shifting from collecting identities to proving what you can demonstrate.

1. Why It Matters: Congress Stalls, Agencies Fill the Gap

On September 15, the Digital Asset Market Clarity Act (H.R. 3633) failed a 49-50 procedural vote in the Senate, with disagreements centered on officials’ crypto holdings and stablecoin yield. Before the November midterms, congressional crypto legislation is all but stalled. So the SEC and CFTC are each acting on their own: the SEC is advancing Regulation Crypto Assets, proposing registration exemptions up to $5 million and $75 million for crypto startups, with public comments open through October 20; CFTC Chairman Michael Selig confirmed the agency will use its existing authority to shape market structure and has sent a comprehensive regulatory proposal to the White House.

For practitioners, a “legislative vacuum” does not mean no rules; it means the granularity of regulation shifts from congressional statutes to agency rules. Uncertainty has not disappeared, it has merely changed its source.

2. Current State: Peirce’s Farewell Speech Puts ZK on the Record

At the SIFMA Digital Assets Conference in New York on September 23, Peirce, who steps down on October 2, delivered what amounts to a farewell manifesto. She criticized the current KYC/AML regime for resting on the flawed premise of “collecting more and more data,” describing regulators as piling up “ever bigger data haystacks” and turning financial rails into a “panopticon.” She argued for zero-knowledge proofs (ZKP) and attribute-based credentials that verify age, accredited-investor status, or sanctions-clearance without exposing name, address, or income.

This is not abstract: the SEC’s Crypto Task Force met with ZK-identity firm Aztec as early as July 17 to discuss its ZKPassport system, which verifies government IDs locally on the device and outputs only a cryptographic proof of whether a condition is met. Peirce’s speech, now part of the official SEC record, is a citable federal artifact and marks the first time “data minimization” has entered institutional regulatory discourse as a principle.

3. Deep Dive: From “You Must Be Named” to “You Must Be Able to Prove”

Peirce’s proposal goes straight to the heart of agentic finance. In August, Coinbase formally introduced AiFi (Agentic Finance): when AI agents research, decide, and execute on behalf of individuals and enterprises, they also need to pay, receive, hold, and transfer value, but the traditional financial system “assumes a real person behind every transaction,” which for machines means broken flows. Coinbase’s Agent Wallet attempts to give agents on-chain identity, but whether regulators will accept such an “identity” remains unsettled.

This is where “compliance by cryptography” proves its worth. Unlike humans, AI agents cannot open accounts and submit ID documents one by one; but they can hold an attribute credential issued by a trusted party and use ZK to prove to a counterparty “I am authorized to make this payment of no more than X” or “I have passed sanctions screening,” without exposing their internal logic. The agentic commerce panel at EastPoint: Seoul 2026 (9/28) reinforced this: Kite AI’s Cindy Shi stressed that for agents to transact autonomously at millisecond speed, firms must build a “delegated authority” structure with separate permissions by task, country, transaction type, and limit, rather than simply “handing a credit card to a child.”

At the infrastructure layer, capital is flooding into this identity segment: Baselayer raised a $35 million Series A and launched Agentic Identity Suite to verify AI agents transacting on behalf of humans; Socure (valued at $5.2 billion) is folding Fravity’s agentic AI into its stack and integrating on-chain identity verification with Circle Arc, a network built for the agent economy; Keyrock reports that AI agents settled more than $73 million across roughly 176 million transactions on-chain over the past 12 months. Identity and trust decisions are moving from after-the-fact accountability to the front of every automated payment.

4. Investment View: Identity Layer and Compliance Stack Become a New Track

The market has already begun pricing this shift. The ZK sector rose about 3-5% overall after Peirce’s speech; modest in the short term, but if “compliance by cryptography” becomes the SEC’s mainstream path, KYC/AML/tax reporting could all run through on-chain circuits, sharply cutting institutional compliance costs for entering DeFi. Meanwhile, the spot Solana ETF, listed less than eight weeks ago, hit a single-day inflow peak of $86.7 million and pushed AUM past $1.5 billion, with institutions directly comparing “allocating to SOL ETF” versus “allocating to short-term Treasuries.” The valuation premium of compliance-identity vendors such as Socure and Baselayer reflects market bets on the “front-end authority” of the agent era.

The risks are just as real: ZK compliance today has neither a legal definition nor a regulatory sandbox, and with only Atkins and Uyeda left on the SEC after Peirce departs, whether this direction survives depends entirely on her successors. Agentic payments still concentrate in low-value API calls, and before they scale, accountability must be settled. When an agent executes a payment beyond its instructions, whether the liability falls on the user, the model developer, or the platform has no clear answer yet.

5. Consumer and User View: Permissions as a Shield, Not a Constraint

For ordinary users, the most tangible result of “compliance by cryptography” is not abstract regulation but a change in how payments are authorized. At the EastPoint: Seoul 2026 panel, Kite AI compared giving an agent authority to “handing a credit card to a child”; what is really needed is not handing over the card but setting permissions by task, country, transaction type, and limit. Google Cloud’s Joe Hwang added that because AI models can produce wrong outputs, deterministic controls must be built outside the model: identity checks, security safeguards, and spending caps. In other words, users will gain a more granular “digital wallet remote control,” where every automated agent payment runs on a revocable, auditable rail rather than an unrecoverable key.

6. Conclusion: Where the Opportunity Lies

The U.S. regulatory vacuum is pushing “compliance by cryptography” from slogan to executable infrastructure. Two directions deserve attention: first, zero-knowledge identity and attribute-based credentials, which solve privacy and compliance at once and are the technical base for an agent to earn “provable trust”; second, agent delegation authority and accountability frameworks, from “authorization by exception” to “who is responsible for exceeding authority,” which will be the precondition for machine finance to truly scale. Whoever first builds a verifiable agent identity layer holds the front-end key to payments for the next decade.