The FATF's horizon scan on artificial intelligence and deepfakes, approved at the 22–24 October 2025 Plenary and published on 22 December 2025, is the standard-setter's first document on generative AI, AI agents and deepfakes as money-laundering, terrorist-financing and proliferation-financing risks. Part I says deepfakes are already used to defeat customer due diligence, including digital ID and biometric verification, with the risk amplified by growing reliance on biometric and video KYC, a 'persistent lag in technology adoption' in AML systems and cross-border complexity; Part II sketches AI agents running automated laundering pipelines, synthetic transaction sequences that mimic legitimate behaviour and agentic sanctions-evasion research. It concludes that these tools 'challenge existing AML/CFT/CPF frameworks, particularly in areas like customer due diligence, identity verification, and transaction monitoring', anchors the response in Recommendation 15 and creates no new requirement.
OFFICIAL TEXT: fatf-gafi.org ↗ · FINAL · FATF
| Document | FATF horizon scan on AI and deepfakes (2025) — Horizon Scan: Artificial Intelligence and Deepfakes — Impacts on Money Laundering, Terrorist Financing and Proliferation Financing |
| Issued by | Financial Action Task Force (FATF) |
| Type | Report |
| Status | Final |
| Published | Dec 22, 2025 |
| Applies to | National authorities, financial intelligence units and law enforcement; financial institutions, virtual asset service providers and designated non-financial businesses as AML/CFT reporting entities (awareness document, non-binding) |
| Official source | fatf-gafi.org ↗ |
| Use cases | AML / KYC · Fraud detection · Generative & agentic AI · Cybersecurity |
What are the key points of FATF horizon scan on AI and deepfakes (2025)?
- Part of the FATF's 'staged approach to emerging technologies', built on a roundtable at the June 2025 Working Group and Plenary meetings; the October 2025 Plenary outcomes announced it as a warning about how criminals 'can exploit generative AI, AI agents and other new technologies'.
- Deepfakes target the Recommendation 10 and 22 CDD requirement to identify customers using 'reliable documents, data or information from independent sources': they are used to 'impersonate individuals, manipulate biometric authentication, or support social engineering schemes'.
- Three amplifiers of deepfake risk: growing reliance on biometric verification (facial recognition and video-based KYC), 'the persistent lag in technology adoption, as many AML systems remain ill-equipped to detect synthetic content', and cross-border complexity in remote identity verification.
- Dual use: Europol's contribution describes both low-skilled criminals using AI-enhanced deepfakes and professionalised launderers running AI-enabled fraud schemes for organised crime.
- Part II names three AI deployment styles that create new ML/TF/PF risk — discriminative or predictive models (including 'algorithmic pattern mimicry' of legitimate transactions), generative AI, and AI agents 'capable of making decisions and taking actions without human intervention' — with 'General AI' flagged as a still-theoretical horizon risk, and gives scenarios: AI-generated invoice 'paper trails', agent-run micro-transaction layering through hundreds of mule accounts, and an agentic system that researches sanctions-evasion routes.
- Detection guidance for institutions: tools that spot inconsistencies in video and audio, multi-layered verification, trained compliance teams working with technology providers; a case box shows an institution's AI anti-counterfeiting system detecting a fabricated storefront photo during transaction-monitoring follow-up.
- Regulatory framing: 'There is currently no consistent or enforceable global standard on the regulation of AI'; the FATF's own hook is Recommendation 15, which requires reporting entities to identify and assess risks associated with emerging products, and the scan cites the 2021 new-technologies report as the baseline.
What did FATF horizon scan on AI and deepfakes (2025) change for banks?
It is the FATF's first statement that generative AI, AI agents and deepfakes are live AML/CFT/CPF threats rather than future ones, and the first time the standard-setter has described agentic laundering scenarios. It does not amend the Recommendations or issue guidance; it tells banks, FIUs and supervisors to strengthen safeguards and 'harness AI responsibly', and it sits behind FinCEN's deepfake alert, the HKMA's AI-in-AML work and the EBA's AI reporting as the global reference point.
Which FATF standards do AI and deepfake risks hit, according to the horizon scan?
The horizon scan ties each risk to an existing FATF text rather than to a new rule. Deepfakes attack the 'reliable, independent' verification requirement of Recommendation 10 (and Recommendation 22 for non-financial businesses) and the digital ID assurance approach of the 2020 guidance; synthetic transaction sequences and agent-run layering attack the ongoing scrutiny of transactions under Recommendation 10(d) and the reporting duty of Recommendation 20; and the FATF's answer to all of it is the pre-launch technology risk assessment of Recommendation 15 plus the safeguards of the 2021 new-technologies report.
| Rule | Authority | What it requires | Applies |
|---|---|---|---|
| Recommendation 10 (and 22) — customer due diligence | FATF | Identify customers using 'reliable documents, data or information from independent sources'; the scan says deepfakes are used to impersonate individuals and manipulate biometric authentication to circumvent CDD. | In force |
| Guidance on Digital Identity (2020) | FATF | Assess the assurance levels of digital ID systems; the scan's three amplifiers (biometric reliance, detection lag, cross-border complexity) are the gaps that assessment must now cover. | Non-binding guidance |
| Recommendation 15 — new technologies | FATF | The 'broad and inclusive approach to New Technologies' the scan invokes: reporting entities identify and assess risks associated with emerging products, including deepfakes and autonomous agents. | In force |
| Opportunities and Challenges of New Technologies for AML/CFT (2021) | FATF | The baseline the scan cites for using AI defensively: explainable, human-overseen, privacy-respecting and cyber-secure AML technology. | Non-binding report |
WHAT THIS MEANS IN PRACTICE
- Test video and biometric onboarding against synthetic-media attacks and record the result in the Recommendation 15 risk assessment.
- Add agent-driven patterns — bursts of micro-transactions across many new accounts timed to low-risk windows — to transaction-monitoring typologies.
- Treat AI-generated invoices and shipping documents as a trade-finance red flag; the scan describes agents producing complete fake paper trails.
What does the FATF horizon scan say about AI agents?
It lists AI agents — 'autonomous systems capable of making decisions and taking actions without human intervention' — among the AI deployment styles that create new money-laundering risk, and describes scenarios in which agents automate recruitment of mule accounts, execute high-volume micro-transactions through gaming and gambling platforms when risk is lowest, generate fake documentation for layering, and research sanctions-evasion routes.
Does the FATF horizon scan create new obligations for banks?
No. It is an awareness document. It says the existing Standards apply, with Recommendation 15 requiring reporting entities to assess the risks of new technologies, and it asks stakeholders to strengthen safeguards around customer due diligence, identity verification and transaction monitoring.
How should a bank respond to the FATF deepfake warning?
The scan points to detection tools that identify inconsistencies in video and audio content, multi-layered verification, and compliance teams trained with technology providers; the FATF's 2020 digital identity guidance supplies the assurance-level framework those controls fit into.
| Date | Document | Status |
|---|---|---|
| Jul 1, 2021 | FATF new technologies for AML/CFT report (2021) — Opportunities and Challenges of New Technologies for AML/CFT | Final |
| Jul 1, 2021 | FATF data pooling and collaborative analytics stocktake (2021) — Stocktake on Data Pooling, Collaborative Analytics and Data Protection | Final |
| Mar 6, 2020 | FATF Guidance on Digital Identity (2020) — Guidance on Digital Identity | Final |
| Feb 15, 2012 | FATF Recommendations — International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation: The FATF Recommendations (consolidated text updated October 2025) | In force |
| Sep 3, 2026 | FIN-2026-Alert005 (Digital Asset Investment Scam Centers) — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers | In force |
| Jul 24, 2026 | FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid | In force |
Follow every document these regulators publish
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning