business resources
AI Agents Need a Passport, and Minnesota Online Casinos Never Got One
21 Oct 2026
The most interesting idea on the business press this week isn't about chips or models. It's about paperwork. When a software agent can open an account, move money and sign up for a service without a human touching a keyboard, someone has to answer one blunt question: who is this, and who is responsible for it?
That question has an old, boring, well-tested answer in finance. It's called KYC. And it turns out online gambling has been living with a broken version of the same problem for years.
Why identity became the story
Banks are already rewriting their playbooks. The industry now has a phrase for it, "know your agent", and Fortune has covered how financial firms are extending compliance checks to software that shops and pays on its own. The logic is simple. A human customer shows a passport, a utility bill, a face. A machine shows nothing, unless somebody builds the rules that make it show something.
The standards bodies are circling the same gap. NIST has floated a concept paper on identity and authorization controls for AI agents, covered by Biometric Update. It reads like a very polite way of saying the old assumptions are dead.
Here's my take. Strip away the AI glamour and this is a story about accountability. Every regulated market runs on three things: proving who you are, proving you're allowed to be there, and leaving a trail if something goes wrong. Remove any one and the whole structure gets wobbly.
How it works for humans, and why it breaks for machines
A licensed casino operator in a mature market does a lot of identity work before you ever spin a reel. Government ID upload. Selfie match. Address check. Age gate. Source-of-funds questions once you deposit past a threshold. I've sat through all of it, usually on a Sunday night with a blurry passport photo and a support agent who wanted it re-uploaded. Annoying? Yes. Necessary? Also yes.
That friction is the product. It's what lets a regulator say "this player is 21, real, and not on a self-exclusion list" and mean it.
Now bolt an AI agent onto that system. A bot placing bets on someone's behalf. A script farming bonuses across fifty accounts. A synthetic identity built from a leaked document. The checks designed for a person holding a passport don't map cleanly onto any of it. PYMNTS made the point well when it described how legacy KYC controls fall apart once agents start initiating transactions. Cheap to fake? Not anymore, but still cheaper than the cost of catching it.
A regulated market at least has a framework to argue about. Minnesota doesn't.
The Minnesota gap
Minnesota hasn't licensed a single online casino operator, which means the state has no framework for any of this. No required identity standard. No state-backed age verification rule. No regulator who can order a platform to pull a player's account. So residents who want to play don't stop playing. They go offshore, and Minnesota online casinos end up meaning whatever the international operators decide they mean, with identity and accountability sitting entirely outside state oversight.
The 2026 session made the picture worse, not better. The sports betting bill died. A prediction-market bill aimed at Kalshi and Polymarket moved quickly. A sweepstakes-casino ban went nowhere. That's three different outcomes for three different products, with nothing coherent tying them together.
Players don't notice the policy gap. They notice the signup flow. And offshore flows vary wildly: some operators demand a full document check before a withdrawal, others barely look. A few ask for nothing until you try to cash out a big win, at which point they ask for everything. I've had a withdrawal frozen for six days over a utility bill that was apparently the wrong shade of grey. No state agency to call. No complaints desk. Just a support ticket and patience.
That's the same structural hole the bank regulators are now trying to close for AI agents. Without a recognised identity layer, accountability has nowhere to attach.
What a passport model would actually fix
The agent-identity crowd keeps landing on the same toolkit, and it transfers neatly to gambling.
A verifiable credential, not a self-declaration. The Cloud Security Alliance describes a governance vacuum around non-human identities, where machine accounts vastly outnumber human users and nobody tracks them properly. Swap "machine accounts" for "anonymous player accounts" and the shape of the problem is identical.
Delegation you can audit. If an agent acts for you, there should be a record saying you authorised it, for what, and until when. Academic work on agent identity management calls this delegation and authorization. In a casino context it would be the difference between a person betting and a script betting under a person's name.
A named party who answers. This is the part regulators care about most. Somebody holds the licence. Somebody can be fined, suspended or shut down. Offshore operation breaks that chain by design.
None of this requires exotic technology. Most of it exists already in banking. What's missing is the decision to apply it.
The counterargument
Plenty of people will say a heavy identity regime just pushes more players offshore, since friction drives users toward whoever asks fewer questions. They're not wrong. UK players have been making that argument for years, and the self-exclusion workaround economy is proof the pressure is real.
But that argues for designing the system well, not for having no system. A licensed market with proportionate checks, fast verification and clear dispute rights competes on trust. An unlicensed one competes on speed and silence. Which would you rather hand your passport scan to?
The tribal question complicates it further. Any Minnesota framework has to sit alongside existing tribal gaming compacts, and that stalemate is the main reason nothing has moved. Identity rules are the easy part. Agreeing who gets to issue the licences is the hard one.
What to watch
Three things are worth tracking over the next year. First, whether the bank-side "know your agent" rules become a template other regulated sectors copy. Second, whether Minnesota's 2027 session revisits online casino licensing at all, or just the prediction-market question. Third, whether offshore operators tighten verification on their own as payment processors get stricter.
I wouldn't bet on the second one. I'd bet on the first and third.
FAQ
Why is machine identity relevant to online gambling? Both fields depend on proving who is acting and who is accountable. Banks are building "know your agent" rules because software can now transact alone. Gambling faces the same issue with bots, bonus farming and synthetic accounts, and licensed markets already have tools to address it.
Are there licensed online casinos in Minnesota? No. As of October 2026 the state has not authorised any real-money online casino operators, and the 2026 legislative session ended without a gambling expansion bill passing. Residents who play online use offshore sites that operate under foreign licences and their own verification rules.
What does KYC involve at a regulated operator? Typically a government ID upload, a selfie or liveness check, proof of address and an age verification step. Larger deposits can trigger source-of-funds questions. The process exists so a regulator can confirm a player is real, of legal age and not self-excluded.
Could AI agents place bets for players? Technically yes, which is exactly the concern. Without delegation records, an operator can't tell a person from a script acting under that person's name. Regulated markets can require disclosure and audit trails. Unregulated ones generally don't.
Does stricter identity checking push players offshore? It can, if the checks are slow or clumsy. Proportionate rules with fast verification and clear dispute rights keep players inside licensed markets. The failure mode is heavy friction with no benefit, which is a design problem rather than an argument against identity rules.
The bottom line
The machine-ID debate isn't a sideshow. It's a clean demonstration of what happens when a market grows faster than the paperwork behind it. Minnesota online gambling is the same story with older technology: lots of activity, no recognised identity layer, no accountable party at home.
Gambling involves risk. Please play responsibly and only wager what you can afford to lose. If you feel gambling is becoming a problem, visit BeGambleAware.org or call 1-800-GAMBLER.
Share
Peyman Khosravani
Industry Expert & Contributor
Peyman Khosravani is a global blockchain and digital transformation expert with a passion for marketing, futuristic ideas, analytics insights, startup businesses, and effective communications. He has extensive experience in blockchain and DeFi projects and is committed to using technology to bring justice and fairness to society and promote freedom. Peyman has worked with international organisations to improve digital transformation strategies and data-gathering strategies that help identify customer touchpoints and sources of data that tell the story of what is happening. With his expertise in blockchain, digital transformation, marketing, analytics insights, startup businesses, and effective communications, Peyman is dedicated to helping businesses succeed in the digital age. He believes that technology can be used as a tool for positive change in the world.
