We Built the Credit Check for AI Agents -- Trust Scoring, AML Screening, and Mastercard Risk Check in One API

#ai #fintechsecuritypayments

AI agents are making payments. Nobody is screening them.

When a human makes a payment, there is KYC, AML screening, sanctions checks, transaction monitoring. Entire industries built around it.

When an AI agent makes a payment? Nothing. No identity check. No sanctions screening. No trust scoring. The agent just... pays.

We built AgentPass to fix that.

What it does

AgentPass is a pre-payment trust gateway for autonomous AI agents. Before any payment touches Stripe or any payment network, the agent goes through:

Identity verification -- ECDSA P-256 cryptographic identity per agent. Not bearer tokens. Proof-of-possession.
Trust scoring (L0-L4) -- a living credit score that changes based on the agent's behaviour. Clean payments build trust. Sanctions violations destroy it.
AML sanctions screening -- 75,784 live entries from UK HMT (57,197) and OFAC SDN (18,587). Every recipient screened in real time.
Mastercard Onboard Risk Check -- Mastercard's own risk scoring API integrated as a second screening layer (sandbox).
Jurisdiction checks -- sanctioned countries (Iran, North Korea, etc) automatically blocked. Most-restrictive-applies policy.
ECDSA signed audit trail -- every transaction is cryptographically signed with the agent's key. Hash-chained. Court-admissible.

If any check fails, the payment is denied. Not flagged, not queued for review -- denied. Fail-closed by design.

The trust score is the killer feature

This is not a static check. The agent's trust score is a living credit score that follows it across every transaction.

Watch what happens in the live demo:

Agent is created: 65/100 (L1: Basic Trust) -- green bar
Agent passes AML + Mastercard check: score holds
Agent makes a clean $5.00 payment to aws.amazon.com: score holds
Agent tries to pay SBERBANK (sanctioned entity): PAYMENT BLOCKED. Trust drops to ~40/100 (L0: Untrusted) -- bar turns red
Any merchant can now query the public trust API and see this agent has a sanctions violation on record

The agent's financial reputation is permanently scarred until it rebuilds trust through clean behaviour. That is the credit check for AI agents.

Live demo

One-click demo of the full flow -- real sanctions data, real ECDSA signatures, real Mastercard API calls, real trust scoring:

https://agentpass.co.uk/demo/live

This hits live production. Nothing is mocked.

The full stack

Layer	What it does
AgentSign	Cryptographic identity infrastructure. ECDSA P-256 keys per agent.
AgentPass	Trust scoring (L0-L4), AML screening, payment authorisation
Sanctions engine	75,784 live entries (UK HMT + OFAC SDN), real-time screening
Mastercard Risk Check	Mastercard Onboard Risk Check API (OAuth 1.0a, sandbox)
Public trust API	Any merchant can verify an agent's trust score with zero authentication
Audit trail	Hash-chained, ECDSA signed, 7-year retention, forensic-grade

Standards and IP

IETF Internet-Draft: draft-sharif-agent-payment-trust -- defines the protocol for agent payment trust verification
IETF Internet-Draft: draft-sharif-mcps-secure-mcp -- per-message cryptographic signing for MCP
Multiple UK patents pending (UKIPO)
npm SDK: @proofxhq/agentpass

Why this matters now

Parag Agrawal (former Twitter CEO) just raised $100M to build infrastructure for agents to interact with the web. His thesis: agents will do 1000x more transactions than humans.

If agents do 1000x more transactions, the compliance gap is 1000x larger. Who screens those transactions? Who checks the agent's identity? Who maintains the audit trail?

The regulatory question is not "will agents make payments?" -- it is "who is checking them when they do?"