The problem is not recognising every deepfake
In 2025, the EBA reported a supervisory case in which several financial institutions had identified criminal networks exploiting generative technologies, including deepfakes, to bypass standard remote identity-verification measures. The same case refers to impersonation of real people, false identities, acquired existing companies and money mules. The operational point is not to train analysts to win a visual contest against AI: it is to prevent one apparently valid signal from closing the verification.
Document ✓ Face ✓ Video ✓ — verified identity? Not necessarily
A plausible document, a matching face and a convincing video session can be three passed checks without yet proving that the person is who they claim to be or is authorised to act. AMLR requires identification and verification of the customer and, where relevant, the person acting on the customer’s behalf; verification may rely on identity documents and reliable independent sources or qualifying electronic-identification means within the applicable framework.
The AMLR generally applies from 10 July 2027. Today’s process must meet the rules already applicable to the entity; comparison with the new framework supports readiness rather than bringing every future requirement forward.
- Is the source corroborating identity genuinely independent from material supplied by the customer?
- Do person, document, contact details, account, company and authority tell the same story?
- Are the purpose of the relationship and expected activity consistent with what happens after onboarding?
- Does a discrepancy trigger proportionate review, or disappear inside an aggregate score?
Verification continues after onboarding
AMLR also connects CDD to purpose and intended nature and to ongoing monitoring. This matters for synthetic identity risk: even when entry looks regular, behaviour, counterparties, flows and source of funds can contradict the original story. Identity should not be treated as a single snapshot, but as a relationship between evidence that needs to remain coherent over time.
AI vs AI is not enough: a human decision remains
Proposed review: distinguish the identity document’s apparent consistency from the independence of its source. If document, video and caller originate from the same unverified channel, their agreement is not three independent checks. Record which independent evidence resolves the discrepancy and who owns any remaining escalation.
A practical test for your process
Take a recent remote onboarding and mentally remove trust in the video. Ask which other evidence would still support identity, authority and customer coherence. If the answer still depends on the same document, the same device or information supplied by the same person, the process may have several steps but only one real source of trust.
- Which control would fail if both document and face were synthetic?
- Which independent source could corroborate the decisive fact?
- Which later behaviour would reopen the verification?
- Who can override or escalate, and with what documented evidence?
Document verification ≠ identity assurance
Document, video and caller all come from the same unverified channel. Three consistent signals may still share one compromised source.
Check the source, the person’s authority and the account relationship using independently established evidence. Record the gap that remains and who decides the next review.
Sources and references
Informational content. It does not replace an assessment of a specific case.
EBA — Report on ML/TF risks affecting the EU financial sector, 2025 (Box 7: misuse of AI during remote onboarding)FATF — Horizon Scan AI and Deepfakes, 22 December 2025Regulation (EU) 2024/1624 — AMLR, Articles 20 and 22