Head of Compliance Juan McGuinness, is keeping a watchful eye on all things AI and Customer Due Diligence (CDD). In this article he explores what is happening and how we can all stay safe.
As compliance continues to evolve, particularly in the Isle of Man’s TCSP (Trust and Corporate Service Provider) sector regulated by the Isle of Man Financial Services Authority (FSA), we are increasingly confronted by the rapid advance of artificial intelligence (AI) technologies. Among the most visible and debated of these is AI-generated imagery, which is raising new and complex challenges for CDD processes.
At first glance, the use of technology to collect and verify CDD seems like a win. Faster onboarding, streamlined identification (ID) verification, biometric checks, automated screening — all these innovations promise efficiency. However, the same tools also present new risks when combined with the sophistication of AI.
An emerging concern is the use of AI-generated or manipulated images, such as deepfakes or synthetic IDs, to bypass CDD checks. Traditional document verification tools may not yet be fully equipped to detect these sophisticated fakes. For example, an AI-generated passport photo or ID card might pass a visual inspection or even some software scans if the tools rely solely on surface-level image analysis. As AI models grow more advanced, the risk of synthetic identities slipping through the cracks increases, potentially opening the door to increased risk of exposure to money laundering, fraud, or terrorist financing.
The compliance challenge is clear: technology is evolving much faster than regulation. Current regulations, including the Isle of Man’s AML/CFT framework and the FSA Rulebook, are based on sound principles such as knowing your customer, understanding their source of wealth and source of funds, assessing risk, and maintaining ongoing monitoring. But these are based in a world where identity documents were physical.
The key is for compliance teams to stay anchored to the principles, not just the tools. Even if technology offers tempting shortcuts or automated solutions, the responsibility to assess and verify remains with the regulated entity. If a CDD process fails because a system was fooled by an AI-generated image, the liability, both regulatory and reputational, ultimately still sits with the firm.
Awareness and training are critical, as staff must understand the limits of technology and recognise red flags in digital CDD. Vendor due diligence is another important area, ensuring that third-party service providers involved in ID verification or screening are keeping pace with the latest fraud and forgery trends, including AI risks. Finally, ongoing monitoring remains essential, recognising that CDD is not a one-time event but a continuous process of risk assessment that can help catch discrepancies over time.
Ultimately, while regulation may take time to catch up with AI-specific risks, compliance teams can and should act now by reaffirming their commitment to the underlying AML/CFT principles. Technology will always evolve, but the ethical and regulatory duty to protect the integrity of the financial system remains constant.
We take governance seriously, we also know that when we complete CDD adhering to all the rules laid out by the various associations and authorities, it can feel overwhelming at times but it is worth it. Once a customer is set up we can traverse clients easily through our various specialist teams such as Customs, Tax and Ownership making onboarding and high value asset transactions fast.
If you have any queries regarding CDD and the points raised in this article, please contact martin@martynfiddler.com
