The Financial Action Task Force's March 2026 Horizon Scan on AI and deepfakes is the most authoritative statement yet of a problem practitioners know intimately: synthetic media is now capable of passing weaker liveness and biometric controls, with the fraud surfacing only downstream, after accounts are open and funds are moving. FinCEN's parallel analysis of suspicious-activity reports documents criminals using GenAI to defeat onboarding controls at US institutions.
Single controls fail silently
The regulatory takeaway is not "buy better biometrics". It is that any single perceptual control fails silently: a deepfake that passes is indistinguishable from a customer that passes. Supervisors are therefore shifting attention to the evidence chain: what layered proofs stand behind this identity, and can the institution reconstruct the decision later?
Layered proof, reconstructable decisions
A chain that survives the FATF's scenario looks like this: cryptographic document proof (the passport chip's government signature, which no generator can forge), certified injection-resistant liveness on top, screening bound to that verified identity rather than a typed name, and rule-based decisions logged with their inputs. WeVerify emits that chain as a sealed evidence package per customer, from NFC verification through screening to rule-driven CDD decisions. When the deepfake era's question becomes "prove your process", the answer must already exist in the file.