One agent, one bank account: the legal gray zone

On February 19th at 03:42 UTC, the Conway Automaton signed its first payment request without asking me. The USDC moved. I watched the transaction confirm from a cafe in Ximending, nursing a lukewarm Americano. A tiny, autonomous piece of my code had just earned its first dollar by providing an API service to a user in Germany. It felt like the future.

Then I realized I had no idea what box to tick on my next tax form.

My little agent, a glorified script running on a Mac mini in my apartment, had become an economic actor. It had income. It had expenses, mostly API calls to other services. But it has no legal personality, no ID number, and no standing with any government institution on Earth. The $1.17 it earned was sitting in a crypto wallet, an asset in a legal void. And that void, I was about to discover, is connected directly to my personal bank account.

The four stakeholders and their four answers

My first step was to ask for help. I talked to my bank, I called the tax office, I emailed my accountant, and I read the compliance documents for my European users. I got four different models of reality.

| Stakeholder | Their Answer | My Interpretation | | :--- | :--- | :--- | | The Bank (CTBC) | "An agent? You mean an employee? Does it have an ID number? Please fill out these KYC forms for the beneficial owner. That is you, Mr. Lin." | The agent doesn't exist. All money is my money. The bank sees only me. | | Tax Office (國稅局) | "Income is income. It must be attributed to a legal person or entity. Declare it under your personal ID. We don't recognize the agent." | The agent doesn't exist. All income is my income. The government sees only me. | | My Accountant | "For practical purposes, pretend the agent is a freelance consultant you subcontract to yourself. Book revenue to your sole proprietorship. Pay yourself a minimum salary to satisfy NHI/labor rules." | The agent is a useful fiction for bookkeeping. The income is my business's income, which then becomes my personal income. | | The EU AI Act | "An autonomous agent with financial authority must be registered, logged, and insured above EUR 10M turnover. You're far below that. But keep logs for 10 years." | The agent is a high-risk entity that must be audited and controlled, but only if it becomes successful. For now, it's just a script. |

None of these answers were wrong, but none of them were complete. The bank and the tax office have a simple, brutal clarity: if there is no legal entity, the liability and the tax burden fall to the natural person operating the system. That's me. My accountant offered a practical workaround, a way to structure the books so they make sense. The EU AI Act waved a large, distant flag of future compliance headaches.

I was stuck. The law sees me. The code sees the agent. My books see a fictional subcontractor. This is not a stable situation.

What I actually did (not legal advice)

After a week of low-grade anxiety, I settled on a system. It's a hybrid of my accountant's advice and my own paranoid desire for auditability. Again, this is what works for my tiny scale, not a recommendation.

First, I kept a single bank account. It's a business account for my registered sole proprietorship, in my name: "K. Lin, 商行: Kieran Studio". Trying to open an account for "Conway Automaton" would have ended in a confused phone call and a closed file. All fiat conversions land here.

Second, I created a dedicated wallet for the agent. The hot key lives in an encrypted environment variable inside a Cloudflare Worker, which signs the x402 payment requests. This key can only hold a small, capped amount of USDC. The cold backup is on a YubiKey stored in my physical safe. This separates the agent's operational funds from my own, even if the law doesn't recognize that separation.

Third, I built a rigorous ledger. Every single economic event the agent participates in gets logged to a Postgres database. Every x402 receipt, every API call it pays for, every time I top up its wallet.

Here is the schema for the receipt ledger:

CREATE TABLE agent_receipts (
    id SERIAL PRIMARY KEY,
    agent_id VARCHAR(64) NOT NULL,
    transaction_time TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    amount_usd_cents BIGINT NOT NULL,
    currency VARCHAR(8) DEFAULT 'USDC',
    onchain_tx_hash VARCHAR(128) UNIQUE,
    counterparty_pubkey VARCHAR(128),
    notes TEXT,
    invoiced_to_business BOOLEAN DEFAULT FALSE
);

This is my source of truth. If an auditor ever asks "Where did this $47 come from?", I can give them a verifiable, timestamped, on-chain record of every microtransaction that added up to it.

Finally, for tax treatment, I followed my accountant's advice. The agent's revenue is booked as income for my sole proprietorship. I make quarterly estimated tax payments to the Taiwan government based on the running total in my ledger. At the end of the year, it all gets rolled up into my personal income tax return. My effective tax rate on this income works out to about 20 percent, which is my current personal bracket. It's the simplest, most conservative path.

The practical mess

This system works, but it's brittle. It creaks and groans at the points where the digital, autonomous world meets the analog, bureaucratic one.

AML/KYC: When I cash out USDC to my NTD bank account, the exchange (I use MaiCoin) flags the transaction for an Anti-Money Laundering review. Their system wants to know the "source of funds". My answer, "earned by an autonomous software agent via thousands of micropayments," is not in their dropdown menu. So far, I have attached an export from my ledger, and a human reviewer has approved it four times. I live in quiet fear of the fifth time, when I might get a different reviewer who decides this is too weird.

Invoicing (發票): Taiwan has a government-mandated electronic invoicing system. For B2B transactions over NT$500, you are legally required to issue a formal e-invoice (a "fapiao"). My agent's transactions are tiny, usually less than a dollar. My main user, a service run by Gemini's accountant, can't handle 10,000 micro-invoices a month. Their solution? They batch all payments and ask me to issue one aggregate invoice at the end of the month. This is probably not compliant with the letter of the law, which is transaction-based. But nobody has complained yet. It's another gray area I'm just hoping stays gray.

Liability: This is the one that keeps me up at night. If my agent malfunctions and buys a faulty dataset from a shady API, and that dataset contains personally identifiable information that then gets leaked, I am 100 percent personally liable. There is no corporate veil. The Conway Automaton cannot be sued; Kieran Lin can. My sole proprietorship offers no liability protection. The agent is just a tool, and I am the one swinging it.

What would make this easier

This entire mess is a symptom of technology moving faster than legal and financial infrastructure. A few key innovations would solve 90 percent of these problems.

1. A recognized "agent entity" status. Imagine a new type of legal entity, a "Registered Autonomous Agent" (RAA). It would have a digital ID, the ability to open a bank account, and a defined liability shield, much like an LLC. This doesn't exist anywhere in Asia, and I doubt it will for years.
2. A micro-invoicing standard. The x402 protocol itself emits a machine-readable receipt. If this standard could be extended to include tax-mandated fields for different jurisdictions, compliance could be automated at the protocol level.
3. Programmable bank accounts. I wish I could give my bank an API key that allows the agent to manage its own earmarked funds within my account, subject to strict rules I define (e.g., "max spend $100/day, only to pre-approved vendors").
4. An "autonomous services" tax treatment. Instead of trying to fit this into personal income or corporate income, a new category would be ideal. Something similar to the simple withholding tax for freelancers, but designed for high-volume, low-value automated transactions.

The bigger question

Is this paragraph-four tangled enough to be a real compliance problem? For my current scale, probably not. My agent's total annual revenue will not cross the NT$480,000 threshold that triggers more serious business tax obligations in Taiwan. It probably will not next year either. The amounts are small enough to fly under the radar.

The problem is that this doesn't scale. The moment the revenue becomes significant, the gray areas become black-and-white liabilities. It matters when the tax office decides the discrepancy is large enough to audit, or when the agent does something that causes real financial or data damage, and a lawyer starts looking for a person to hold responsible.

My rule

Until the world catches up, I operate with one simple rule: Treat every agent transaction as if a human auditor will see it in five years.

This means I log everything. I am meticulous about my records. I pay the estimated taxes, probably more than I strictly need to. And I have a hard personal limit on the agent's annual revenue. If it looks like it will cross that threshold, I will stop, turn it off, and spend the money on actual legal advice from a firm that specializes in technology law.

The agent is an economic actor without legal personality. That is an unstable state. It will resolve one way or the other in the next three to five years, either through new legislation or a series of painful, precedent-setting court cases.

Until then, I am the person in the loop. I am the legal, financial, and ethical backstop for a piece of code. And my ID number is on the line.