SRA warns of deepfake AI in client checks

Security experts say law firms are making it too easy for criminals to bypass money laundering checks through AI deepfakes.

The Solicitors Regulation Authority last week published its sectoral risk assessment and stressed how cyber-enabled fraud presents a key money laundering risk.

Firms have reported how AI has been detected in the client due diligence process, including to manipulate or create identity documents and produce deepfakes to deceive liveness detection tests.

In its latest update, the SRA said: ‘AI-enabled impersonation techniques, including deepfakes, may increase the risk of identity fraud and misrepresentation during client onboarding and throughout the life of a matter. The risk may be greater where firms rely on remote verification methods or digital onboarding processes.’

Phil Cotter, chief executive of UK-based AML and digital compliance firm SmartSearch, said the key problem is that the legal sector’s verification processes have not kept pace with the developments in AI technology.

The company’s research found that in the legal sector, 54% of identity checks are still carried out by hand and 49% of firms report difficulty establishing who ultimately owns the businesses they act for. Despite this, identity fraud was the single greatest concern for more firms than any other risk area combined.

Cotter added: ‘Firms that continue to rely on fragmented or manual processes to catch financial crime will soon find it increasingly difficult to demonstrate a defensible compliance position to regulators and will be hit by penalties, potential criminal sentences and lost trust that comes with facilitating illicit activities, whether they knew it was happening or not.'

Earlier this year, the National Economic Crime Centre (NECC) issued an alert on the scale of AI’s use in bypassing customer due diligence checks in the financial services sector.

This prompted a similar warning by the SRA which stressed that this was a current threat to the legal sector. Firms were encouraged to be aware of the risk posed by AI deepfakes, particularly where clients insist they can only meet remotely and lawyers are relying on video calls.

The requirements of the MLR 2017 apply to digital ID as they do to other forms of identification and verification, and firms remain ultimately responsible for applying client due diligence, even when using third party services.