Regulators Target AI‑Powered Sanctions Evasion: New Rules for Synthetic Identities, Compute‑KYC, and Automated AML

1. Regulatory action – Synthetic Identity Verification Directive (SIVD)

The European Commission, together with the Financial Action Task Force (FAFT), has published the Synthetic Identity Verification Directive (SIVD), formally titled Regulation (EU) 2026/1124 on Enhanced Verification of Digital Identities. The directive directly addresses the threat outlined in RUSI’s Algorithms of Evasion report, where generative AI can produce passports, bank statements and corporate filings that pass static biometric checks.

What it requires

• Dynamic biometric authentication – financial institutions must supplement selfie or voice‑print checks with liveness detection, challenge‑response prompts, and continuous behavioural analytics (e.g., typing rhythm, mouse movement patterns).
• AI‑generated document detection – banks and fintechs must deploy at least one approved AI‑based forensic tool capable of flagging synthetic documents. The tools must be trained on a publicly‑available dataset of AI‑generated forgeries released by the European Cybersecurity Agency (ENISA).
• Cross‑border data sharing – member states must feed flagged synthetic‑identity alerts into the EU‑wide Sanctions Evasion Early Warning System (SEEWS) within 24 hours of detection.

Compliance timeline

Date	Milestone
1 Oct 2026	Publication of the official SIVD text and list of approved forensic tools.
1 Jan 2027	Mandatory pilot phase for large banks (assets > €50 bn).
1 Jul 2027	Full enforcement for all regulated entities, with penalties up to 2 % of annual turnover for non‑compliance.

---

2. Regulatory action – Compute‑KYC Obligation for Cloud Providers

The United Kingdom’s Office of Financial Sanctions Implementation (OFSI) and the U.S. Office of Foreign Assets Control (OFAC) have jointly issued the Compute‑KYC Obligation (CKO), a set of rules that require cloud service providers (CSPs) to perform “knowledge‑of‑customer” checks on any end‑user renting more than 500 GPU‑hours per month for AI model training.

What it requires

• Identity verification – CSPs must collect verified corporate documents, beneficial‑owner information and source‑of‑funds evidence before provisioning high‑performance GPU resources.
• Usage monitoring – providers must log model‑training jobs, retain metadata for at least 12 months, and flag workloads that generate large volumes of synthetic media (e.g., > 10 GB of image/video per day).
• Sanctions screening – CSPs must integrate real‑time OFAC and EU sanctions lists into their provisioning pipelines, denying access to any entity appearing on those lists.
• Audit rights – regulators receive quarterly audit reports and may request on‑site inspections of CSP compliance programs.

Compliance timeline

Date	Milestone
15 Nov 2026	Publication of the Compute‑KYC technical standards by the International Organization for Standardization (ISO/IEC 42001).
1 Mar 2027	Mandatory registration of all GPU‑intensive customers with the new Global Compute Registry.
1 Sep 2027	Full enforcement; violations may trigger fines up to $10 million per breach or suspension of cloud services.

---

3. Regulatory action – AI‑Enhanced AML Toolkit Mandate (AETM)

The Financial Conduct Authority (FCA) in the UK, in coordination with the International Monetary Fund’s Financial Integrity Unit, has mandated the adoption of an AI‑Enhanced Anti‑Money‑Laundering Toolkit (AETM) for all entities subject to the EU’s Fifth AML Directive.

What it requires

• Automated transaction pattern analysis – institutions must deploy machine‑learning models that can detect rapid, algorithm‑driven shifts in crypto‑mixing routes, DeFi token swaps and cross‑chain bridges.
• Synthetic‑entity risk scoring – the toolkit must assign a risk score to every corporate customer based on the probability that its ownership structure is AI‑generated, using graph‑analysis of public registries and natural‑language processing of incorporation documents.
• Real‑time alert escalation – alerts with a risk score above 80 % must be escalated to senior compliance officers within 30 minutes of generation.
• Reporting – a monthly summary of AI‑detected anomalies must be submitted to the Global Financial Crime Reporting Hub (GFCRH).

Compliance timeline

Date	Milestone
1 Dec 2026	Release of the AETM Reference Implementation (open‑source code on GitHub).
1 Apr 2027	Required for all “systemically important” financial institutions (SIFIs).
1 Oct 2027	Mandatory for all other regulated entities; non‑adoption results in a compliance rating downgrade and potential licence restrictions.

---

4. What these rules mean for the industry

1. Banks must upgrade identity pipelines – static selfies are no longer acceptable. Institutions should budget for liveness SDKs, behavioural analytics platforms and the approved forensic AI tools listed in Annex A of the SIVD.
2. Cloud providers become a front‑line regulator – the Compute‑KYC Obligation turns CSPs into de‑facto gatekeepers for AI compute. Vendors that already offer “AI‑Ready” managed services will need to expose their KYC workflows to regulators.
3. Compliance teams must acquire data‑science capability – the AETM requires staff who can interpret model outputs, tune risk thresholds and integrate alerts into existing case‑management systems.
4. Cross‑jurisdiction coordination is essential – the three measures rely on shared data feeds (SEEWS, Global Compute Registry, GFCRH). Companies should establish a single point of contact for each of these registries to avoid duplication and ensure timely reporting.

---

5. Next steps for organisations

Action	Deadline
Conduct a gap analysis against SIVD requirements	30 Nov 2026
Register GPU‑intensive workloads with the Global Compute Registry	15 Mar 2027
Pilot the AETM open‑source toolkit on a sandbox crypto‑transaction feed	31 May 2027
Train compliance staff on liveness detection and synthetic‑identity risk scoring	30 Jun 2027

By aligning internal processes with these three regulatory pillars, firms can reduce the risk of being unwitting conduits for AI‑driven sanctions evasion while demonstrating to supervisors that they are keeping pace with the evolving threat landscape.

Featured image: A stylised illustration of AI agents generating synthetic documents, highlighting the regulatory focus on automated fraud detection.