What Does the FATF Digital Identity Guidance Say About Deepfakes and Remote Onboarding?

What does the FATF Guidance on Digital Identity actually require?

The guidance interprets one phrase in Recommendation 10(a): customers must be identified and verified using "reliable, independent source documents, data or information". FATF reads that, for digital ID, as a system whose technology, processes and governance give an appropriate level of confidence that it works as intended, produces accurate results and resists manipulation by outsiders or insiders. It is guidance for authorities and regulated entities, not a new Recommendation and not a product certification scheme.

Paragraph 139 sets out two assessments. First, understand the assurance levels the digital ID system provides, based on its technology, architecture and governance. Second, make a risk-based determination of whether those levels are appropriate for the money laundering, terrorist financing, fraud and other illicit finance risks of the customer, product and jurisdiction. A decision flow then asks whether the government already stands behind the system for CDD; if it does, the entity can rely on it for standard-risk CDD but may still need extra measures in higher-risk cases.

FATF is explicit that the guidance does not endorse any technology, including biometrics or mobile phones. That neutrality matters for deepfakes: the question an examiner asks is whether your identity proofing and authentication achieve the assurance you claim, not which vendor or model you chose.

Is non-face-to-face onboarding high risk under FATF rules?

No, not automatically. The Interpretive Note to Recommendation 10 lists non-face-to-face business relationships as an example of a situation where risk may be higher. Paragraph 88 of the guidance says this does not require anyone to always classify remote relationships as higher risk, and paragraph 89 says remote identification that relies on reliable, independent digital ID with appropriate mitigation may present a standard level of risk, and may even be lower risk where higher assurance levels are implemented.

The guidance goes further for regulated entities. Its recommendation 25 asks institutions that treat every remote relationship as high risk to review that policy. Recommendation 26 encourages them to use anti-fraud and cybersecurity processes to support identity proofing and authentication. Both points assume the remote channel actually delivers its stated assurance. A face match that a synthetic face can pass, or a selfie capture that accepts a virtual camera feed, removes the condition that made the lower risk rating defensible.

How do NIST 800-63 and eIDAS assurance levels fit into the FATF approach?

FATF relies on existing assurance frameworks rather than writing its own. Appendix E summarises the US NIST SP 800-63 levels (Identity, Authentication and Federation Assurance Levels) and the EU eIDAS levels of assurance for notified electronic identification schemes: low, substantial and high, detailed in Commission Implementing Regulation (EU) 2015/1502. The 2020 summary reflects NIST revision 3, which was current at the time.

Two details from that summary bear directly on deepfakes. IAL2 allowed unsupervised remote proofing with biometrics optional. IAL3 required in-person proofing, which NIST defines to include supervised remote sessions, with mandatory biometrics and an operator who inspects the biometric source for non-natural materials. Unattended selfie onboarding has no operator, so whatever checks the media must be automated. For the current EU framework, see our page on eIDAS and the European Digital Identity Wallet.

What does the FATF digital identity guidance mean for deepfakes and injection attacks?

The 2020 text never uses the words deepfake or injection. It describes the same risks in older terms. Paragraph 117 names the presentation of false evidence through impersonation or synthetic identities as a main threat to enrolment, and paragraph 114 warns that criminals may hack or spoof authenticators linked to a legitimate identity. It also separates proofing risk, which produces a fake digital ID, from authentication risk, where a legitimate ID is taken over. Deepfakes now operate on both sides of that line.

Injection attacks are the harder case. A presentation attack holds a mask, screen or printout in front of a real camera, which presentation attack detection tested to ISO/IEC 30107-3 is designed to catch. An injection attack replaces the camera output itself, for example through a virtual camera or emulator, so the liveness check may never see a physical artefact. The FATF guidance predates both the cheap generators and the tooling that make this routine.

NIST closed part of the gap. SP 800-63-4, released in final form in July 2025, lists new controls for injection attacks and forged media such as deepfakes. Section 3.14 of SP 800-63A-4 states that credential service providers shall implement controls to increase confidence that media comes from a genuine sensor, shall analyse all submitted digital media for artefacts and indicators of manipulation, and shall test automated image analysis against available attack artefacts. It adds that providers should analyse media for signatures of generative AI and deepfake tools, use passive detection in all capture scenarios, and back algorithmic decisions with manual review. Because FATF tells regulated entities to understand the assurance framework a digital ID system claims, those revision 4 controls are now part of what that understanding should cover.

How has FATF's later work on AI and deepfakes built on the 2020 guidance?

FATF's horizon scan "Artificial Intelligence and Deepfakes: Impacts on Money Laundering, Terrorist Financing and Proliferation Financing" (2025) builds on a roundtable held at the June 2025 Working Group and Plenary meetings. It states that criminals can use deepfakes to circumvent CDD systems, including digital ID verification, and that deepfakes can impersonate individuals and manipulate biometric authentication. It names three amplifiers: growing reliance on facial recognition and video KYC, AML systems that are ill-equipped to detect synthetic content, and cross-border complexity in accepting remote identity verification.

The scan points back to the 2020 guidance and its "informed risk-based approach to relying on digital ID systems", and says institutions now need a CDD framework that considers this threat landscape. Its case studies describe authorities encouraging advanced liveness checks that combine passive and active detection, AI-driven detection within KYC, deepfake detection software for investigators, and behavioural indicators such as rapid transfers to newly opened accounts or one device shared across different customers. It also cautions that detection techniques can quickly become obsolete, which is an argument for testing detectors against current attacks on a schedule.

How should a regulated entity build a risk-based CDD control set for synthetic media?

Start from the two FATF assessments and map each threat to a layer that produces evidence. The list below is a practical structure, not a regulator's checklist; national law and supervisor instructions decide what is mandatory.

Detection helps most where the evidence is media: a selfie, a video frame, a recorded voice. It helps least against threats that never touch media, such as a compromised identity service provider, insider misconduct, a stolen but genuine document used by a lookalike, or mule accounts opened by real people. Those still need governance, authoritative data checks and transaction monitoring, as the FinCEN deepfake alert also stresses for US institutions.

• State the intended reliance: which CDD step the digital ID supports, at what assurance level, for which customer and product risk tiers.
• Validate identity evidence against issuing or authoritative sources; a media check does not replace document validation.
• Test captured faces and video for presentation attacks, face manipulation and generative AI artefacts, and record signal-level results for audit.
• Check capture integrity: device attestation, virtual camera and emulator signals, and authenticated channels, in line with SP 800-63A-4 section 3.14.
• Route ambiguous results to trained reviewers with defined escalation, and tighten account limits until review is complete.
• Re-test the same controls at account recovery and step-up authentication, then monitor transactions after onboarding.

Where does NeuroVerify fit in FATF-aligned remote onboarding?

NeuroVerify is Neural Defend's authenticity layer for the media part of that control set. One API call checks a face image, video or audio and returns one unified risk score with signal-level evidence from six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Eligible image requests return in under 200 ms at p95 under defined test conditions, so the check can run inline in onboarding, recovery and step-up flows. Your policy, not the model, decides approve, review or decline.

On the public VendorBench-100 benchmark, which tests 36 systems on 100 adversarial still images, Neural Defend ranked first with an MCC of 0.876 against 0.646 for the next-best vendor. One VendorBench author also co-authored Neural Defend's ARCAS 1B model paper, and the corpus and results are public so anyone can rerun them. The benchmark does not measure video, audio, injection attacks or latency, so it supports the face manipulation claim only.

NeuroVerify does not analyse ID documents and cannot certify a digital ID system as meeting FATF or national AML requirements. What it adds to the paragraph 139 assessment is recorded, reviewable evidence that the face in front of the system was genuine. It deploys as a managed cloud API, private cloud or VPC, secure container, on-premises or air-gapped, and Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications, which supports vendor due diligence for regulated buyers.