Key points
- Trust Stamp launched a biometric consent product for transactions started by AI agents on Nov 10, 2026.
- The product is called Knowing Consent and runs on the company’s Orchestration Layer or one API call.
- Account owners confirm each action with a live selfie checked for proof of life.
- Trust Stamp said it can be deployed “in a matter of days”.
Trust Stamp, a Nasdaq-listed identity company, launched a product on Nov 10 that asks a bank customer to approve each transaction an AI agent starts. The company calls it Knowing Consent. It uses a live selfie to confirm that the account owner, not the agent, authorises the action.
Trust Stamp said the product is built for financial institutions that must tell whether a customer is truly approving a request when an agent uses their credentials. The company said it combines existing patented processes with a new one that is being patented.
How the agentic AI biometric authorization works
On first use, the customer completes biometric registration to create a personal identity token, Trust Stamp said. After that, either the AI agent or the bank can start a request. The customer then gets a prompt by SMS, email, push notification or inside the bank’s app to take a secure selfie.
The company said the selfie goes through proof-of-life and anti-spoofing checks, with optional device verification. An approval screen shows the specific action before the live check. Trust Stamp said each approval applies to that single request and is not tied to a stored password or earlier permission. See our guide to biometric authentication for how these steps fit together.
Why banks are cautious about agents
The release cited a NIST article by Bill Fisher and Ryan Galluzzo that said “Credential sharing is a bad idea in all contexts.” It also pointed to Reuters reporting that some large US banks are blocking third-party agents, and quoted JPMorgan Chase CEO Jamie Dimon calling unrestricted outside agents “too risky for clients and for JPMorgan.”
Trust Stamp CEO Gareth N. Genner said the company has more than one hundred financial institutions integrated with its Orchestration Layer. He said human-centred controls “already exist and are proven to be effective,” in contrast to proposals to identify the agents themselves. These are the company’s own claims, and the release gave no independent test results. Selfie data also counts as sensitive biometric data.
Open questions remain. Will banks accept a selfie prompt for every agent action, or will customers tire of it? How will liveness checks hold up against deepfakes aimed at the approval step? And who is liable when an approved agent transaction goes wrong?
