Aipedia: Company formation and secretarial agents

Deepfake IDs and forged documents at formation agent onboarding

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Formation agents now face AI-generated passports, synthetic identities and deepfake selfies designed to pass remote checks. Forming a company for a fraudster can breach AML duties, put ACSP status at risk and lead to claims from people the company later defrauds.

Part of: AI in Company formation and secretarial agents

In short

Generative AI makes it cheaper to produce convincing fake identity documents and to fool selfie and liveness checks with manipulated video. Formation agents are an attractive target because a UK company with a verified director can be used to open accounts, invoice victims or launder money. The agent remains responsible under the Money Laundering Regulations 2017 and, as an ACSP, must meet the Companies House assurance standard. PI may respond to third-party claims alleging negligent checks, subject to the wording, but fines and the agent's own losses usually need other cover or fall outside insurance.

How fraudsters target formation agents with AI

Company formation is quick, remote and relatively low cost, which is why it attracts criminals. AI has lowered the skill needed to get through onboarding, and the main techniques are these:

Generated or altered documents: passports and utility bills created or edited with image tools, with consistent fonts and plausible data.
Synthetic identities: a fictional person built from a mix of real and invented details, sometimes with an online footprint to match.
Deepfake liveness attacks: manipulated or replayed video fed into the selfie step to impersonate a real person or animate a fake one.
Recruited nominees: real people paid to verify and act as directors for someone else, which no document check will catch.

The aim is usually a company with a verified director and a clean filing history that can then be used elsewhere.

Onboarding fraud is one of several AI risks covered in AI in company formations.

The duties that apply

The agent's obligations do not reduce because the fraud was sophisticated. The main ones are these:

Customer due diligence, risk assessment, record keeping and suspicious activity reporting for TCSP and formation services under the Money Laundering Regulations 2017.
For ACSPs, identity checks that give the same assurance as verification with Companies House. Companies House runs random checks and may suspend or cease an ACSP that falls short, according to its blog of 11 December 2025.
Since 18 November 2025, identity verification has been a legal requirement for directors, PSCs and LLP members, so a false pass puts a fraudster on the register as verified.

Larger corporate service groups should also review their own fraud prevention procedures in light of the failure to prevent fraud offence.

What can go wrong

Illustrative scenario: a formation agent receives an online order for a new company with a sole director. The passport passes the AI document check and the selfie passes liveness. The director's address is a serviced office and the stated business is consultancy. Within months the company has been used to invoice businesses for services never supplied. Police enquiries reveal that the director's identity was synthetic and the selfie a manipulated video.

The consequences can include the AML supervisor reviewing the agent's due diligence files, a Companies House investigation into its verifications, reputational harm and, potentially, civil claims from victims alleging the agent's checks were negligent. Whether such a claim would succeed is uncertain, because a duty of care to third parties is not straightforward, but defending it still costs money.

Whether PI or crime cover responds

PI commonly responds to civil claims alleging negligence in the professional services, including defence costs, subject to the wording. A claim by a victim of the client company, or by a genuine client whose transaction was disrupted by the fallout, could fall into that category. Policies usually exclude dishonest acts by the insured, but failing to detect a third party's fraud is a different question.

Other losses usually sit elsewhere. Regulatory fines are commonly outside PI. If fraudsters use deepfakes to trick the agent's own staff into paying money, that is typically a commercial crime or social engineering matter rather than PI; see CEO fraud and deepfake payment scams. For the PI position in more detail, see does formation agents' PI cover AI errors?.

Practical controls

A layered approach makes AI-generated identities harder to slip through:

Use verification tools that test for injected or replayed video, and ask the provider how they detect deepfakes.
Treat a clean pass as one signal; look at the order pattern, address, payment method and stated business.
Apply enhanced checks to remote, rushed or nominee-style orders.
Keep records of every verification and the human decision behind it.
Report suspicions through the firm's nominated officer and avoid tipping off the client.
Review the AI identity check and AI client risk scoring processes together.

How Apex helps

Apex arranges PI and crime cover for corporate service providers. A broker can look at how your policies divide losses from forged or deepfaked identities and where gaps remain.

Sources

Frequently asked

Can AI liveness checks detect deepfakes?

Some tools test for replayed or injected video, but no check is perfect and attack methods change. Treat a pass as one piece of evidence and look at the wider order pattern, especially for remote, urgent or nominee-style formations.

What should an agent do if it suspects a fake identity?

Stop the formation, record the reasons and report through the firm's nominated officer under its suspicious activity procedures. Avoid alerting the client. Review whether earlier orders from the same source used similar documents, addresses or payment details.

Will PI cover claims from people defrauded by a company we formed?

It may, subject to the wording. PI commonly responds to civil claims alleging negligent professional services, including defence costs. Fines, the agent's own losses and dishonesty by the insured are usually excluded.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.