A customer opens an account in minutes. The passport looks genuine. The face on screen matches the photograph. The application passes.
What if the person behind it is using an identity assembled from stolen details, altered documents and an AI-generated video?
This is an uncomfortable problem for financial institutions investing in faster digital onboarding. The same technology that helps firms identify suspicious applications can help criminals produce more convincing ones. The FCA has highlighted how deepfakes and synthetic identities can exploit onboarding and decision-making processes.
For compliance teams, the task is to understand where AI improves verification, where it introduces uncertainty and what evidence is needed before trusting its results.
Electronic know your customer, or eKYC, uses digital processes to support customer identification and verification. It forms part of customer due diligence; confirming someone’s identity does not, by itself, establish the purpose of an account, the legitimacy of their funds or the wider risks of the relationship.
Risk-based due diligence is already an established principle. AI can help firms apply it more effectively by examining information that might otherwise sit in separate systems: document details, biometric results, device signals and inconsistencies across an application.
Used well, this can reduce time spent on routine checks and help staff concentrate on cases that need closer attention. It may also improve consistency, particularly where manual processes involve repetitive work or substantial application volumes. These benefits depend on the quality of the data, system configuration and testing.
Consider a new applicant whose identity evidence has been independently validated and whose details are consistent across reliable sources. That application may require fewer additional enquiries than one containing conflicting information. An unexplained mismatch between a document, a selfie and device activity might instead prompt further verification.
Extra checks should respond to meaningful evidence. An unfamiliar device or an applicant travelling abroad should not, on its own, be treated as proof of fraud.
AI-assisted identity fraud takes several forms. An impersonator may use another person’s genuine details. A synthetic identity may combine real and fabricated information. A deepfake may manipulate the face or voice presented during verification. These are different problems, and a control designed for one may perform poorly against another.
Facial matching, for example, assesses whether images appear to show the same person. It cannot independently establish that the identity document is authentic or that the video came from a trustworthy capture process.
Liveness detection adds another check, but its effectiveness depends on the technology and the attack. A system that detects a photograph held in front of a camera may still be vulnerable to manipulated video injected directly into the verification process.
Firms therefore need to test the complete onboarding process. Document authentication, biometric checks, capture security and independent information sources should support one another. Several apparently reassuring signals offer limited protection if they all depend on the same compromised source.
Testing should also reflect how criminals actually behave. A demonstration using clear photographs and straightforward applications says little about performance against altered documents, poor connections, repeated attempts or deliberate efforts to bypass controls.
There is another side to verification failure: the legitimate applicant who keeps being rejected.
Their passport may be valid, but the photograph is difficult to capture. Their document type may be poorly supported. A facial recognition model may perform less reliably for their demographic group. After several attempts, they abandon the application or contact a member of staff who can offer no useful explanation.
These failures deserve attention alongside successful fraud attempts. They can exclude customers, generate complaints and leave staff working around a process they do not understand.
Performance monitoring should examine both false acceptance and false rejection, including differences across relevant customer groups and document types. Any additional personal data collected for fairness testing must itself be handled lawfully.
Human review also needs to be practical. A reviewer should have access to the relevant evidence, understand the system’s limitations and have authority to challenge its recommendation. If the only information available is a red warning icon and an unexplained score, meaningful oversight will be difficult.
Customers should have an accessible route to resolve verification problems, including suitable alternative checks where appropriate.
For EU financial institutions, the EBA Guidelines on remote customer onboarding provide an important reference for assessing and governing these processes within the AML/CFT and data protection frameworks. Buying an identity verification service does not remove the institution’s responsibility to establish whether its arrangements are appropriate.
Data protection requires particular care. Under the EU GDPR, firms need a lawful basis for processing personal data. Where biometric data is processed to uniquely identify a person, an applicable condition for processing special category data is also required. The ICO makes the corresponding distinction explicit in its UK guidance: a lawful basis and a separate special category condition must both be identified.
This means asking practical questions before implementation. Which images and biometric templates are retained? For how long? Who can access them? Does the provider use customer information to develop its own models? Is a data protection impact assessment required?
Significant solely automated decisions need separate consideration. EU and UK rules should be assessed individually. The UK’s Data (Use and Access) Act 2025 changes its automated decision-making framework, including safeguards concerning information, challenge and human intervention. Firms operating across both jurisdictions need to check the applicable provisions and their commencement rather than assume identical requirements.
The EU AI Act adds a further assessment. An eKYC product is not automatically high-risk simply because it uses AI or biometrics. Annex III’s remote biometric identification category excludes verification whose sole purpose is to confirm a claimed identity. Other functions may require a different assessment, so firms should examine the system’s intended purpose and components rather than rely on a vendor’s general description.
The UK’s digital verification services trust framework offers a useful comparison. It recognises four identity confidence levels – Low, Medium, High and Very High – with GPG 45 explaining how evidence and checks support those levels.
Confidence that someone is who they claim to be is different from confidence that a business relationship presents an acceptable financial crime risk. A correctly identified customer can still require enhanced scrutiny.
Certification can provide useful assurance within its stated scope. It does not replace a financial institution’s own due diligence or supersede other legal requirements. Firms should check the service covered, the framework version and the certificate’s validity.
A supplier presentation is a starting point. Before approving a system, the firm should be able to answer five questions:
– What has been tested? Evidence should cover realistic fraud attempts, relevant customer populations, document types and operating conditions.
– What happens when the system is uncertain? Escalation thresholds, alternative checks and staff responsibilities should be clear.
– How will performance be monitored? Both missed fraud and wrongly rejected customers matter, including changes after model updates.
– Can a decision be reconstructed? Records should preserve the material evidence, system version, relevant thresholds and human interventions, within lawful retention limits.
– Who owns the problem when something goes wrong? Contracts and internal responsibilities should address incidents, subcontractors, data use, audit access and service changes.
The firm also needs to distinguish between information required for internal scrutiny and information provided to an applicant. Customers need meaningful explanations and applicable safeguards, while detailed disclosure of fraud detection rules may enable abuse.
AI can make onboarding quicker and help uncover inconsistencies that a busy team might miss. It can also produce a confident answer from incomplete evidence.
Staff need to know when a result is reliable, when further checks are justified and when the process itself may be failing a genuine customer. That judgement becomes more important as verification tools grow more complex.
Six months after an account was opened, a compliance officer should be able to examine the record and understand why the firm accepted the evidence. An unexplained “pass” is a weak foundation for that conversation.
EIMF’s AI-Powered eKYC Solutions for Fraud Prevention in the Financial Industry examines digital identity verification, emerging fraud methods and the governance of AI-enabled compliance tools, including human oversight, data protection and auditability.
Questions for your organisation
Can your compliance team explain and challenge an identity verification result using the evidence available to it?
When did you last test the full onboarding process against both sophisticated fraud attempts and the difficulties genuine customers encounter?
Join us to gain insights from Alana Hill, learn practical strategies for turning conflict into opportunity, and discover how challenges can drive growth and stronger team performance.
On All Self-Paced eLearning CPD Courses in Financial Regulation
Hosted by the EIMF and the Chartered Governance Institute
Engage with 20+ leading experts and earn 6 CPD units in Financial Regulation.
Not sure if it’s right for you? Let’s talk.
Discount Coupon: NYNY10
Valid until 31 Jan 2025 23:59
Register now to receive a valuable educational resource each day and be automatically entered into our Grand Christmas Draw on 24th December – Don’t miss out!
On Self-Paced eLearning Courses
*complete your purchase before 21 April 2024