Deepfake
Also called synthetic media, AI-generated media
A deepfake is image, audio or video content generated or altered by AI so that it falsely appears to show a real person or event. In financial services, criminals use deepfakes to pass remote identity checks, impersonate executives on calls and forge identity documents. Detection now forms part of KYC and fraud controls.
How it works
A fraudster creates a synthetic face or voice and presents it during video onboarding, a selfie check or a call with staff. Firms counter this with liveness detection, injection-attack detection, document forensics and call-back procedures. Analysts look for mismatches, such as a selfie that does not match device data or a video with visual artefacts.
Deepfakes undermine the remote checks that digital onboarding depends on. FinCEN told US institutions in November 2024 to flag suspected deepfake fraud in SARs with a set key term. Since 2 August 2026 the EU AI Act requires deployers to disclose deepfake content they publish.
The rules
Requires deployers to disclose deepfake content and providers to mark AI-generated output in a machine-readable format.
Providers and deployers of AI systems generating synthetic contentDescribes deepfake fraud typologies and red flags and asks institutions to use key term FIN-2024-DEEPFAKEFRAUD in related SARs.
US financial institutions subject to the Bank Secrecy ActCommon questions
How do deepfakes affect KYC?
They can defeat selfie matching and video verification by presenting a synthetic face, or by injecting pre-recorded video into the camera feed. Firms add liveness and injection detection to counter this.
Does the EU AI Act ban deepfakes?
No. Article 50 requires transparency. Deployers must disclose that content is a deepfake, and providers must mark synthetic output in a machine-readable format. Systems already on the market before 2 August 2026 have until 2 December 2026 for the marking duty.
What should US institutions put in a SAR about deepfakes?
FinCEN asks institutions to include the key term FIN-2024-DEEPFAKEFRAUD in SAR field 2 and in the narrative when reporting suspected deepfake-related activity, so FinCEN can identify and analyse these cases.
Our coverage
News and analysis on KYC and identity from RegTech Post.
Read the coverage →RegTech PostHow AI and Deepfakes Are Reshaping KYC in Financial ServicesRead the article →RegTech PostBiometric KYC Comes of Age: The Next Frontier in Digital IdentityRead the article →
