back

The Synthetic Customer: How AI is Starting to Beat KYC and AML Controls

Sep 8, 2026

The emerging financial-crime threat is not simply synthetic identity. It is synthetic credibility.

Artificial intelligence is reshaping the financial-crime landscape by enabling criminals to construct not just false documents or manipulated images, but apparently credible customers. Traditional KYC and AML controls remain sound in principle: establish identity, ownership, purpose and risk, then apply enhanced scrutiny where necessary. The challenge is that AI is beginning to undermine some of the assumptions on which those controls rely.

Recent reference points underline the direction of travel. FATF has warned that AI and deepfakes can circumvent customer due diligence, fabricate documentation, support synthetic identities and enable more sophisticated laundering or sanctions-evasion structures. FinCEN has reported fraudulent identities suspected of being generated using generative AI, while the UK’s National Crime Agency has identified AI-generated false documentation in fraud, money laundering and organised immigration crime.

The challenge is moving from identifying false documents to identifying false realities.

The real threat is synthetic credibility

Synthetic identity fraud is not new, but generative AI changes its speed, scale and sophistication. Criminals can combine compromised personal data with fabricated attributes, generate realistic faces, manipulate images, produce supporting documents and create wider digital footprints that make an identity appear believable. Cifas reported that identity fraud accounted for 59% of UK National Fraud Database fraud-risk cases in the first half of 2026 and highlighted growing concern around synthetic identities, AI-enabled impersonation and manipulated documentation.

However, synthetic identity is only part of the problem. Businesses increasingly need to consider three related risks: synthetic identity, where genuine and fabricated personal information are combined; synthetic business, where a legally incorporated entity is surrounded by misleading evidence of commercial substance; and synthetic narrative, where a coherent but false explanation of wealth, activity or purpose is supported by apparently corroborating evidence.

The emerging threat is synthetic credibility: the ability to manufacture enough mutually reinforcing evidence that a false proposition begins to look true.

Deepfakes are attacking biometric KYC

Digital identity verification, facial comparison, biometric authentication and liveness technology are now central to onboarding, but criminals are adapting. The European Banking Authority has documented criminal use of generative AI and deepfakes to bypass remote identity checks, and the UK’s Gambling Commission has recorded increasing attempts to evade KYC and CDD controls using false documentation, deepfake videos and AI-generated face swaps.

The question is no longer simply: Does this face match this document? Firms need stronger confidence that the person exists, is participating in real time, is linked to reliable authoritative information, and is supported by consistent device, behavioural, contextual and purpose-based indicators.

The future of KYC is therefore likely to depend increasingly on layered assurance rather than a single verification event.

The company can be real while the business is false

Corporate KYC and KYB face a similar problem. A company may be legally incorporated, have directors on a registry, maintain an address, operate a professional website and provide apparently credible contracts, invoices, supplier details and executive biographies. Each point may appear correct, while the overall commercial reality remains false.

AI reduces the effort required to create that surrounding narrative. FATF has considered scenarios involving shell import-export businesses supported by fabricated records, false invoices, fake websites, virtual suppliers, product catalogues, shipping documentation and correspondence between non-existent actors.

The KYB question therefore needs to evolve from “Does this company exist?” to “Can we independently demonstrate that the claimed business exists?” That requires evidence of economic substance: employees, customers, suppliers, premises, assets, licences, trading history, plausible revenue and a commercial footprint that pre-dates the transaction.

A Companies House record establishes legal existence. It does not automatically establish economic reality.

The collapse of documentary certainty

AI has significant implications for Enhanced Due Diligence, particularly Source of Wealth and Source of Funds work. Customer-supplied documentation may still be valuable, but professionalism, consistency and completeness are no longer sufficient indicators of reliability.

The methodological shift is from “Does this document appear genuine?” to “Can the event described by this document be independently demonstrated?” Where wealth is said to derive from a business sale, for example, EDD should seek proportionate evidence that the company existed, the individual owned it, the business traded meaningfully, the purchaser existed, the transaction occurred, the value was plausible and the funds movement is consistent with the explanation.

This distinction between document verification and event verification is likely to become increasingly important.

Evidence provenance becomes a control

AI also weakens the assumption that multiple sources equal multiple corroborations. A single actor can generate professional content, distribute it across websites, profiles and articles, and create the appearance of independent confirmation. Ten search results do not represent ten pieces of evidence if they ultimately derive from one fabricated claim.

Provenance, independence and chronology therefore become core controls. Higher-value evidence includes authoritative records and independently obtained primary material. Weaker evidence includes self-published biographies, company websites, newly created social profiles and documents of uncertain origin.

The central investigative question is: How far is this evidence removed from the subject’s ability to create, influence or manipulate it?

Chronology may become as important as corroboration

AI can manufacture consistency relatively easily; history is harder. A convincing digital footprint today is less persuasive if it cannot be shown to have existed over time.

Investigators should therefore test chronological integrity: when domains, profiles and business visibility first appeared; whether archived records support the claimed history; whether counterparties mentioned the organisation contemporaneously; and whether the profile expanded suddenly before onboarding or a transaction.

A sophisticated synthetic narrative may be internally consistent. It is much harder to manufacture a genuine past retrospectively across authoritative and independent sources.

A genuine customer can still present a synthetic risk

Not every AI-enabled risk involves a fictitious person. Money mules show why identity verification alone cannot solve AML risk: a genuine individual may present genuine documents, pass biometric checks and own the account, while still acting for another party or enabling illicit activity.

Cifas recorded a 70% increase in money-muling cases in the first half of 2026 compared with the same period in 2025, with nearly 13,000 cases. The principle is clear: knowing who somebody is does not mean knowing what risk they represent.

The same applies to companies. A real company, real director and real bank account can still be part of a fabricated commercial proposition.

When the criminal knows the control

Criminals can increasingly use AI to study the control environment itself. AML typologies, regulatory guidance, red-flag publications and onboarding requirements help institutions, but they can also reveal what institutions are looking for.

FATF has considered adversarial AI analysing typology reports and regulatory material to avoid known red flags, generate transaction behaviour that mimics legitimate patterns and identify regulatory blind spots. This creates a form of adversarial compliance: the proposition is designed with knowledge of how the check works.

Static controls, predictable escalation criteria and rules based only on historic patterns may become easier to avoid. Continuous testing and red-teaming of KYC and AML controls against AI-enabled techniques therefore becomes increasingly important.

The next challenge: transactions designed to look normal

The implications extend beyond onboarding. Traditional monitoring looks for anomalies: unusual value, velocity, geography, counterparties or behaviour inconsistent with the customer profile. AI may increasingly help criminals engineer activity that appears normal.

FATF has considered AI-generated transaction patterns that imitate legitimate behaviour, as well as future scenarios involving AI agents, synthetic company networks and automated movement of illicit funds. The strategic risk is clear: laundering may increasingly seek to disguise behavioural abnormality itself.

This strengthens the case for network analysis, contextual intelligence, dynamic customer profiles and closer integration between onboarding and ongoing monitoring.

The AI-enabled synthetic customer lifecycle

AI-enabled identity fraud, document manipulation, deepfakes and transaction evasion should be viewed as stages of a single attack lifecycle rather than isolated risks.

The lifecycle typically moves from reconnaissance and identity construction to evidence construction, verification attack, trust establishment, exploitation and behavioural adaptation.

The totality of the evidence matters because each individual control may work correctly while the overall proposition remains false.

Regulation still points towards independent evidence and risk-based judgement

Identity technology remains essential, but it does not replace risk-based judgement. In February 2026, HM Treasury and DSIT clarified that certified digital verification services under the UK digital identity trust framework can constitute a reliable and independent source for identity verification under Regulation 28 of the Money Laundering Regulations.

However, digital identity verification does not automatically satisfy all elements of CDD. Firms must still assess customer risk, understand the purpose and intended nature of the relationship and apply EDD where appropriate.

Updates to UK AML guidance and high-risk third-country advisory notices reinforce the same point: CDD and EDD obligations remain risk-based, evidence-led and dependent on the firm’s ability to understand and document the customer, transaction and wider risk context.

Identity assurance can establish who is presenting. It cannot, by itself, establish why they are presenting, whose interests they are serving, or whether the surrounding wealth and commercial narrative are genuine.

Ten principles for AI-resilient KYC and EDD

The practical priorities are clear: include synthetic risk in financial-crime risk assessments; separate identity verification from customer-risk verification; use layered identity assurance; verify critical information at source; test evidence provenance and chronology; assess corporate economic substance; connect customers through networks; red-team controls against AI-enabled attacks; and retain investigative judgement.

From information gathering to reality verification

Enhanced Due Diligence becomes more important in the age of AI, not less. Technology will help detect manipulated documents, deepfakes, network anomalies and suspicious transactions at scale, but sophisticated financial crime has always exploited the gap between information and understanding. Generative AI widens that gap.

At Garancie, we believe EDD should increasingly test the credibility of the underlying narrative, not simply reproduce what registries, databases and search engines say.

This means assessing identity integrity, corporate substance, evidence provenance, chronological integrity, network integrity and behavioural plausibility as connected indicators of whether the reality being presented is independently credible.

Taken together, these questions move EDD beyond data accumulation. They turn it into a test of reality.

Traditional due diligence verifies information. Next-generation EDD must increasingly verify reality.

The most important AI-related threat to KYC and AML may not be better forgery, but scalable synthetic credibility: a person who appears genuine, representing a company that legally exists, supported by information that appears independent, documentation that looks authentic, a plausible history and activity that initially appears normal.

The stronger question is whether firms can independently establish that the underlying person, business, wealth, relationships and activity are genuine — and whether the totality of the evidence makes sense.

The FCA’s 2026 review of AI in retail financial services recognised the amplification of fraud and cyber risk as a major AI-driven change, while the NCA describes technological transformation as a primary driver of the changing serious and organised crime threat. FATF is already considering how AI-generated documentation, synthetic companies, pattern mimicry and intelligent agents may interact.

Yesterday’s control environment asked whether the evidence was authentic. Tomorrow’s must increasingly establish whether the reality represented by that evidence is authentic.

In an environment where convincing evidence can be created at scale, independence, provenance, chronology, economic substance, context and skilled human judgement become some of the controls that are hardest to manufacture.

Sources and further reading

Garancie Limited

Enhanced Due Diligence • Public Record Intelligence • Investigative Research

Contemporary due diligence requires a transition from information gathering to critical source evaluation — and increasingly, from verifying information to independently establishing reality.

#EnhancedDueDiligence #AMLCompliance #KYC #FinancialCrime #ArtificialIntelligence