The fraud landscape is shifting faster than most firms' controls can keep up. A new global survey report from Finextra and FICO, Fraud in the Age of AI: Trends, Threats, and Management Tactics', lays out what financial services firms are seeing on the ground and how they're responding.
What the Survey Reveals
The report draws on responses from financial institutions globally, examining how AI is being weaponized by fraudsters and deployed by compliance and fraud teams in response. Here's what stood out:
Receive future blog posts by email.
- AI-generated deepfakes and synthetic identities are becoming primary vectors for account takeover and new account fraud
- Traditional rule-based fraud detection systems are increasingly insufficient against adaptive AI-driven attacks
- Firms investing in machine learning-based detection are reporting faster identification of anomalous patterns
- Cross-industry data sharing remains underdeveloped despite regulatory encouragement
None of this is theoretical. Broker-dealers and RIAs are already seeing these threats in customer account compromises, wire fraud attempts, and social engineering attacks targeting operations staff.
Operational Implications for Compliance
This isn't just a technology problem. It's a compliance program problem.
Your AML and fraud prevention procedures need to account for AI-enhanced threats. You need to review your CIP for synthetic identity vulnerabilities, stress-test wire transfer verification against deepfakes, and ask whether your transaction monitoring can adapt to new attack patterns.
Specific Areas to Evaluate
- Identity verification: Are your onboarding controls capable of detecting AI-generated documents and synthetic identities?
- Wire transfer protocols: Do your callback procedures account for voice deepfakes?
- Transaction monitoring: Is your system rules-based only, or does it incorporate machine learning for anomaly detection?
- Staff training: Have you updated your social engineering training to address AI-generated phishing and impersonation?
Regulators have made clear that firms are responsible for adapting their programs to emerging threats. FINRA's exam priorities have consistently emphasized cybersecurity and fraud prevention. The SEC's Division of Examinations has flagged similar concerns. Neither will accept 'we didn't anticipate this' as an excuse.
What You Should Do Now
Get the report. Sit down with your ops and tech leads, run a gap analysis on your fraud controls, and document both the gaps and your plan to fix them.
This is the kind of risk assessment that should be happening annually at a minimum, and more frequently as the threat landscape evolves. If your last comprehensive fraud risk review was pre-2024, you're behind.
The firms that take this seriously will be better positioned for both examinations and actual fraud prevention. The ones that don't will learn the hard way that regulators expect proactive adaptation, not reactive scrambling.
Subscribe to Regulated Intelligence Brief
Get new compliance intelligence delivered to your inbox.
Key Takeaways
Does this survey create new compliance obligations for broker-dealers?
No, the Finextra/FICO survey is industry research, not a regulatory requirement. However, existing obligations under FINRA Rules and the SEC's Regulation S-ID require firms to maintain reasonably designed fraud prevention programs. This research highlights emerging threats your program should address.
Should we update our written supervisory procedures based on this report?
If your WSPs don't address AI-enhanced fraud threats like deepfakes and synthetic identities, yes. Your procedures should reflect current threat landscapes. Document your review and any updates made.
Are regulators specifically examining AI fraud controls yet?
Not as a standalone exam priority, but cybersecurity and fraud prevention are perennial focus areas. Examiners will expect your controls to be reasonably designed for current threats -- and AI-driven fraud is increasingly current.
The content in this blog is for informational purposes only and does not constitute legal advice, regulatory guidance, or an offer to sell or solicit securities. GiGCXOs is not a law firm. Compliance program requirements vary based on business model, customer base, and regulatory classification.