Aipedia: Financial advisers

AI for KYC, AML and scam detection

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Advice firms increasingly rely on AI for identity verification, sanctions screening and fraud detection, but they remain responsible when a fraudulent withdrawal or transfer gets through. How the loss is insured depends on whether it is a client claim, a data breach or the firm's own loss.

Part of: AI in Financial advisers

In short

AI tools verify identity documents, match faces to photos, screen names against sanctions lists and flag unusual instructions. At the same time, fraudsters use AI to impersonate clients with convincing emails, voice clones and deepfake video. The Mills Review notes AI may increase fraud. SYSC 8.1.6R keeps firms responsible for outsourced checks. When a fraudulent instruction succeeds, a client claim may fall to PI, a system compromise to cyber cover and the firm's own funds to crime cover, each subject to its wording. Gaps between policies are common.

How advice firms use AI for KYC and fraud prevention

Onboarding increasingly relies on automated identity verification: document checks, liveness tests and facial matching. Sanctions and politically exposed person screening often uses AI-assisted name matching. Some firms use AI to flag unusual instructions, such as a change of bank details shortly before a withdrawal, or an email whose style differs from the client's usual messages.

The threat side has changed too. The Mills Review notes that AI could increase fraud and consumer harm risk. Voice cloning and deepfake video make impersonation of clients, advisers and providers far more convincing than a spoofed email.

Advice firms are attractive targets because they hold detailed personal data and can instruct providers to move large sums. Fraudsters may also impersonate the adviser to the client, for example asking the client to move money into a "new" investment account, or impersonate a provider to the firm. AI tools help on the defensive side, but they work best as one layer in a process that still relies on human verification for high-risk instructions.

The duties that apply

Outsourcing: SYSC 8.1.6R keeps the firm fully responsible for obligations it outsources, including identity and screening providers.
Systems and controls: the FCA AI Update maps safety and robustness to Principles 2 and 3, SYSC 4, SYSC 7 and operational resilience in SYSC 15A.
Anti-money laundering: the firm's customer due diligence obligations under the money laundering regime still apply when checks are automated.
Consumer Duty: PRIN 2A.2.8R requires firms to avoid causing foreseeable harm, which includes reasonable fraud controls.
Accountability: the FCA October 2026 page says firms can outsource AI services but remain responsible for them.

What can go wrong

Automated checks can be fooled by good forgeries or synthetic identities, and false matches in sanctions screening can either block legitimate clients or let real matches through. The bigger risk for advice firms is social engineering: a convincing instruction that appears to come from a client.

Illustrative scenario: an adviser receives a video call from someone who looks and sounds like a long-standing client, asking for a withdrawal to be paid to a new account because of an urgent house purchase. The firm's automated checks pass the new bank details. The client later reveals they never made the call. The client seeks recovery from the firm, the firm's email system may have been compromised, and the firm faces costs of its own.

How PI, cyber and crime cover split the loss

PI usually responds where a client claims the firm was negligent in its professional services, such as failing to verify an instruction, subject to the wording. Some PI policies exclude fraud or cyber-related losses.
Cyber cover commonly responds to the firm's own costs from a system compromise, such as investigation, data restoration and notification, and may include some liability for data breaches. See cyber insurance for IFAs.
Crime cover may respond to the firm's own financial loss from fraud, including social engineering, subject to conditions such as call-back verification. See social engineering and fund transfer fraud.

Gaps arise where each policy assumes another responds. Reviewing them together is the safest approach; see the cyber and PI overlap for IFAs.

Practical controls

Verify any change of bank details or urgent payment request by calling a known number, not one in the message.
Do not treat video or voice as proof of identity for payment instructions.
Review false positive and false negative rates from screening providers.
Train staff on impersonation techniques, including against advisers and providers.
Check that crime cover conditions match your actual verification process.
Flag vulnerable clients who may be targeted by scams.

How Apex helps

Apex arranges PI for financial advisers and can review how your PI, cyber and crime cover fit together for AI-enabled fraud. See AI in financial advice.

Sources

Frequently asked

Is the firm liable if automated KYC checks are fooled?

Potentially. SYSC 8.1.6R keeps the firm fully responsible for outsourced functions, and the FCA's October 2026 page says firms remain responsible for outsourced AI. Whether the firm is liable to a client depends on the facts and whether its controls were reasonable.

Which policy pays if a deepfake instruction diverts client money?

It depends. A client claim alleging negligence may fall to PI, the firm's own system costs to cyber, and the firm's own funds to crime cover, each subject to its terms and conditions. Review the three policies together to find gaps.

Does crime cover need specific verification procedures?

Many crime and social engineering extensions include conditions, such as verifying payment instructions by call-back to a known number. If your process does not match the condition, cover may be affected. Check the wording.

Should I tell clients how we will contact them about payments?

It is a sensible control. Telling clients in advance that the firm will never ask them to move money to a new account by email or message, and how genuine requests will be verified, helps them spot impersonation. It also supports the Consumer Duty aim of avoiding foreseeable harm.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.