In June 2026, an Amsterdam court sentenced a 34-year-old man for opening 47 bank accounts at ABN AMRO using manipulated identity photographs through deepfake technology. The individual was able to create such a high number of accounts by using deepfake selfies stitched onto stolen ID documents he had harvested from social media and a fake apartment rental ad on an online marketplace.
According to media sources, it was only when a human analyst made a manual direct review of these materials that this culprit was caught, as the reviewer noticed one application that paired a woman’s passport with a male deepfake selfie. Without proper KYC remediation, accounts opened like this could continue to sit in a bank registry undetected, even though such accounts can be used for further fraud and money laundering purposes.
This case is also emblematic of ID fraud rising at an alarming rate. In fact, Shufti’s 2026 Deepfake Fraud Index projects a 495 percent surge in deepfake-driven identity fraud from 2025, with document deepfakes alone climbing nearly 3,900 percent. In another report based on data collected from the first half of 2026, Shufti identified 70 fraud attempts that were linked through a network of shared devices, identity documents, and selfies.
Gartner similarly expects that by the end of 2026, 30% of enterprises will no longer consider identity verification and authentication solutions reliable in isolation due to AI-generated deepfakes, and notes that injection attacks rose 200 percent in 2023. Deloitte’s Center for Financial Services further estimates that generative AI-enabled fraud would trigger losses of up to $40 billion by 2027 in the United States alone, rising from an estimated $12.3 billion cost in 2023. Shufti’s Fraud Index has attributed this worrying shift to the transition of generative AI fraud from craft to assembly line, as if fraud itself is scaling in a manner similar to software.
Within that context, another similar issue of generative AI fraud is emerging: deepfake-verified accounts that managed to escape detection are being used for criminal purposes, primarily when deepfake detection technologies were not advanced enough to catch them. These financial services accounts are gaining increasing traction in criminal spaces, with some even being sold in a wider ‘fraud as a service’ illicit market.
Regardless of the estimated scale of this threat posed by these pre-existing deepfake-verified accounts, no regulator or financial services provider has published a credible system-wide estimate of how many existing customer accounts might have been authenticated using generative AI-forged materials. Though some vendor-led analyses like TransUnion’s found that 0.32% of all account opening attempts in 2024 involved synthetic identities, that would have cost the lending industry a potential loss of $3.3 billion in the United States alone.
Considering that a single individual was able to open 47 accounts at one Dutch bank, even the conservative estimates of digital ID fraud across global financial services can be large enough that it would warrant institutions undertaking far-reaching KYC remediation across accounts opened since the proliferation of generative AI technologies. That said, it would be a daunting task for financial services providers.
Such a capability gap in KYC remediation could be closed through the collaboration of public regulators and the private sector. By drawing upon existing public-private partnership (PPP) structures to improve regulatory compliance, public regulators could provide support for KYC remediation on the latter’s accounts, thereby easing much of the burden on the private sector to conduct KYC remediation on accounts verified in the past decade.
The Private Sector is Chafing under a Growing Compliance Burden
Regulatory standards and multiple risk publications provide reasons for reassessing identity controls and remediating KYC, especially since generative AI has advanced past making convincing deepfakes. FATF Recommendation 10 sets an international standard to apply ongoing customer due diligence and reassess existing customers on a risk-sensitive basis. The FATF Horizon Scan on AI and Deepfakes, finalized in late 2025, formally analyses how generative AI-forged identity materials can compromise CDD controls and calls for public-private cooperation to tackle this threat. FinCEN’s Alert FIN-2024-Alert004 furthermore introduced a dedicated SAR key term for deepfake-enabled fraud and suggests that financial institutions often detect AI-generated deepfakes and synthetic content in identity documents by re-reviewing the ID documents. Though Article 50 of the EU AI Act requires specified providers to disclose and mark synthetic media outputs as AI-generated since August 2026, its remit is not global and does not cover every AI generation model that exists today.
Read together, even without necessitating the need for a full-scale identity remediation, these instruments all push for a tighter and more far-reaching CDD approach as fraud typologies outpace detection capabilities. Yet, despite this increasing burden on the private sector, the public sector does not provide institutions with an operational infrastructure to do it.
This puts the institutions into an awkward position, as they might not have the forensic baselines, the triage playbooks, nor the safe harbour norms required to run a portfolio-wide remediation of accounts that may have been authenticated with generative AI materials. Consequently, reviews of legacy accounts routinely slip down the list of priorities due to a lack of required technical resources, guidance on scope, and information on what would happen if findings require SAR filings, especially where regulator expectations are unclear about what “good” KYC remediation looks like.
Where Public-Private Partnerships come in
However, this asymmetry of capabilities can be bridged through existing financial intelligence PPP structures. In these PPPs, financial intelligence units (FIUs) hold law enforcement signals like seized tooling, dated forensic markers, and attribution data which private actors cannot access, while identity verification vendors hold detector telemetry, including failure modes, model versions, and beatable windows.
Neither side alone can produce the forensic baseline that a credible legacy remediation requires, whereas PPP venues can pool some of their respective strengths into a platform where such baselines can emerge. Of course, there are limits to how much intelligence each side can provide; for example, FIUs normally do not provide specific personal data with financial services, instead offering generalized guidance on overall typologies and tactical leads on a case-by-case basis.
In this manner, PPP venues have already proven their utility in improving compliance with other areas of financial crime regulation, which is why FATF’s existing guidance on information sharing, the United States’ FinCEN Exchange, and the United Kingdom’s Joint Money Laundering Intelligence Taskforce (JMLIT) existing infrastructure for PPPs can serve as a starting point for a proposal on a KYC remediation project. Similarly, the BIS Innovation Hub’s Project Aurora offers insights into how to use a phased approach to pilot a project on this issue, as they did on collaborative AML analytics. Encouragingly, there are already signs of PPP approaches to AI risk in the financial services industry as well, with the Cross Market Operational Resilience Group’s (CMORG) AI Taskforce being one such example through its guidance on generative AI risk management.
Four Functions PPPs Are Positioned to Deliver
For KYC remediation, financial intelligence PPPs provide the following functions:
-
Retrospective forensic strategic intelligence
PPPs can systematize the exchange of retrospective threat intelligence. Private institutions report previously undetected deepfake threat patterns surfaced by their own KYC remediation, and FIUs return aggregated typologies and tool inventories that individual institutions could not assemble alone. The Shufti index’s vector taxonomy of presentation attacks, injection attacks, and deepfake-enabled synthetic identity creation illustrates why this matters, as each leaves different forensic traces in onboarding logs, and each has a different window of vulnerability tied to specific detector generations. A shared retrospective view of those windows is a public good that no single private sector institution can produce.
-
Retrospective forensic tactical intelligence
Where the strategic layer maps the wider landscape, the tactical layer enables case-by-case action. When an FIU shares forensic markers from a specific deepfake tool tied to an active investigation, such as hashes, generation artifacts, behavioral signatures, member banks can scan onboarding records from the relevant window for matching signals. The UK-based JMLIT’s expert working groups already circulate analogous indicators for emerging typologies. Hence, extending the model to retrospective markers is merely a step change in capability, not in form.
-
Joint development of detection and remediation infrastructure
Detection alone does not produce remediated accounts, and lab-tested detection alone can’t produce reliable detection in production. Shufti’s Beyond Benchmark Accuracy whitepaper documents that gap with detectors which score well on curated test sets but fail in production. Factors for failure include compression, sensor variation, and re-upload artifacts, which strip away the very signals the detectors depend on. Moreover, pooled telemetry from multiple production environments could help test how well a baseline generalizes beyond one institution.
On the remediation side, Shufti’s Blind Spot Audit suite on AWS Marketplace is one commercial example. Its four engines are designed to review historic selfies, document images, document originality, and liveness captures inside the institution’s own AWS environment without requiring them to move sensitive customer data anywhere else.
What is still missing is the public-private scaffolding around those controls: shared triage taxonomies for hits, playbooks for customer-impact management, supervisory safe-harbor norms for institutions that proactively remediate, and standards for what constitutes a complete look-back. In this regard, BIS Project Aurora’s proof of concept explored collaborative analysis and privacy-enhancing technologies using simulation. This offers a working template for the privacy-preserving data layer, but a gap remains in developing technical, legal, and governance architecture for its applicability to historic identity records.
-
Private sector input on implementation detail of regulatory frameworks
As supervisors move from principle (“reverify on risk triggers”) to practice (“here is the remediation window and the expected methodology”), PPPs are the venue in which private actors can offer input on how regulations are implemented without re-litigating the regulations themselves. Reasonable disagreement about scope, timing, and customer-impact mitigation is better resolved inside PPP platforms like FinCEN Exchange and JMLIT than through enforcement actions after the first major public case.
For example, a proposed pilot could be convened through a national PPP, with the FIU coordinating lawfully shareable intelligence, supervisors clarifying expectations, banks owning investigations and customer decisions, and vendors supporting technical validation. Participants could select one onboarding cohort with a documented control weakness, check whether usable records remain, and test indicators against confirmed cases and a comparison sample. Customer images could remain within each bank, with only permitted indicators and aggregated results shared under agreed access, retention, and purpose limits. Banks would investigate matches through human review and corroborating account evidence, seek fresh verification where justified, and provide a route to resolve errors, subject to reporting and confidentiality duties. The pilot would measure confirmed findings, false positives, review workload, customer disruption, and completed remediation before considering a wider look-back.
Conclusion
Documented cases show generative AI’s capability of compromising onboarding controls and leaving fraudulent accounts active in the existing customer base for years. This raises the interesting question of whether the institutions best placed to act, like FIUs, supervisors, IDV vendors, and banks, can actually build a shared infrastructure to act, or wait for losses and damage this threat can inflict.
Luckily, such action could merely be an extension of existing PPP architecture, especially as commercial vendors have already begun closing that gap unilaterally, like with Shufti’s AWS-deployed audit engines. Building upon such momentum through a coordinated PPP venue, rather than leaving it to vendor-by-vendor commercial offerings, would be the minimum institutional response proportionate to a typology shift that has already happened. As daunting as the task may look, testing such frameworks now could reduce the disruption that could be caused by responding under future enforcement action pressure.
