The compliance technology industry has spent most of the last decade building defences against the previous generation of financial crime. The next five years will be about building defences against threats that didn’t exist two years ago, and that are evolving faster than any regulator, vendor or compliance team is currently keeping up with.

That’s where my focus sits now, and where I believe the next wave of RegTech leadership will be decided.

The pace of AI-enabled fraud over the last 18 months has moved beyond anything the compliance industry has had to respond to before. A member of the finance team at engineering giant Arup transferred $25 million last year after a deepfake video call in which every participant, including the company’s CFO, was AI-generated. That wasn’t a one-off. It was the first widely reported case of a technique that fraud specialists have been warning about for 18 months, and it won’t be the last. Research from Deloitte estimates that generative AI could enable $40 billion in fraud losses by 2027, up from $12 billion in 2023. Consumer-facing scams have scaled in parallel, with regulators across the US and UK now flagging AI-generated voice cloning and personalised phishing as among the fastest-growing categories of fraud reported, particularly against older and vulnerable customers.

What’s changed isn’t just that AI is being used by fraudsters, it’s that the tooling has become cheap, accessible, and good enough to defeat defences that worked a year ago. The same large language models that have become everyday productivity tools, ChatGPT, Claude, Grok and Gemini, are being adapted and jailbroken for fraud at scale. Synthetic identities, where fraudsters combine real and fabricated information to create entirely new personas, are being generated with consistent address histories, employment records, online profiles and social media activity, specifically designed to defeat automated checks that rely on single-source data. AI-generated documents, including passports, utility bills, bank statements and payslips, are now good enough to defeat manual document checks and most automated ones.

Our 2026 UK Compliance Reality Check, based on research with 1,000 senior decision-makers across UK regulated sectors, found that 24% of UK regulated firms now identify AI-generated fraud as their biggest emerging threat. 54% still conduct identity verification manually. The gap between where attackers are and where many firms’ defences sit is widening with every quarter.

Why “AI vs AI” is the wrong framing

A lot of the industry commentary on this topic frames it as an “AI vs AI” problem, where the solution is more AI on the defence side. I understand the appeal of that framing, but it’s incomplete.

The real question is whether defensive AI is built on the right foundations, uses the right data, and operates with the right human oversight.

Defensive AI built on shallow data loses to attack AI built on deep data. If a fraudster can generate a synthetic identity with a consistent address history, employment record and online presence, the only reliable way to catch it is to cross-reference against multiple independent sources that the fraudster can’t have populated. This is the specific reason SmartSearch runs identity verification against triple bureau data, Experian, Equifax and TransUnion, rather than relying on a single source. Multi-source cross-referencing is one of the most effective structural defences against synthetic identity fraud, and it’s one of the foundations our AI defence capabilities sit on.

Without human oversight, Defensive AI loses to attack AI designed specifically to exploit automated decisions. Fraudsters are now using commodity tools, including publicly available LLMs, to probe automated compliance systems. They test thresholds, map alert patterns, and refine their attacks until they slip through. A compliance decision made by AI without human review is a decision that eventually gets gamed. The right model is AI that surfaces risk signals, triages cases, and reduces operational burden, while leaving final decisions in the hands of trained compliance professionals.

Defensive AI that is static loses to attack AI that evolves. The pace of criminal innovation now outstrips the pace of regulatory response, and the gap is being closed only by vendors and firms investing continuously in detection. A compliance platform that isn’t continuously evolving its detection capabilities is losing ground even while it looks the same from the outside.

Where SmartSearch is pushing, and where we are investing next

I don’t believe any single firm, SmartSearch included, has solved the AI defence challenge, a statement that shouldn’t surprise anyone, I’m sure. What I do believe is that this is a problem the industry needs to solve together, with regulators, platforms, firms and the technology community all investing in continuous evolution. We’re investing heavily in that evolution, and I want to share where our focus is.

Data depth is the foundation. Our triple bureau identity verification delivers up to a 97% first-time pass rate, and that depth is specifically what makes synthetic identities harder to construct successfully against our platform. For firms where identity verification is the first line of defence, the depth of the data behind the check matters more than the sophistication of the interface in front of it.

Document fraud detection is a specific focus for our product and engineering teams. SmartDoc, our biometric facial recognition and document verification capability, is designed to detect deepfakes, AI-generated and tampered documents. The threat is evolving quickly, and the detection models we deploy against it are evolving at the same pace. This isn’t a feature we built and shelved. It’s a continuously developed capability where our investment is sustained because the threat landscape demands it.

Fuzzy matching and suppression technology is where we’re working hardest to make compliance teams’ time count. False positive rates of 90% or more are common on enterprise sanctions and PEP screening tools, which means compliance teams spend most of their time working through noise rather than signal. Our fuzzy matching is specifically engineered to cut false positives without compromising detection, so that human expertise is applied where it matters.

Ongoing monitoring is now a baseline requirement, not an advanced feature. A point-in-time check at onboarding is no defence against an identity that evolves, a customer that becomes sanctioned, or a counterparty that comes under adverse media after the relationship starts. Daily ongoing monitoring across the full client base is one of the most under-adopted capabilities in UK compliance, and firms that treat it as optional are the ones most exposed to the AI-enabled threats evolving around them.

Explainable AI with human oversight is where we’re investing most heavily on the forward-looking roadmap. The AI we’re introducing into due diligence reviews is designed to help compliance professionals understand complex information, surface relevant risk signals and reduce manual investigation effort. It isn’t designed to replace human judgement. The source information remains authoritative. The compliance decision remains with the client. Regulators are increasingly scrutinising automated decision-making, and the kinds of fraud we’re talking about defending against are specifically designed to exploit automated systems operating without oversight. Explainable AI with human control is where this must land.

What this means for compliance leaders

If you’re a Chief Risk Officer, Head of Compliance or MLRO reading this, the question isn’t whether to take AI defence seriously. It’s how to evaluate whether your current compliance infrastructure is keeping pace.

The questions I’d start with are these. Where is your data coming from, and is it deep enough to defeat synthetic identities that weren’t possible to construct two years ago? What is your false positive rate, and how much of your team’s time is being lost to noise rather than directed at signal? And is your defence evolving as fast as the threat, or is the platform you bought three years ago still being asked to defend against the threats that exist today?

The regulatory arms race will continue, and SmartSearch will continue to invest in meeting it. But the technical arms race is where the next five years of RegTech will be decided. The attackers are moving faster than many defences, and the industry’s job, with regulators, platforms, firms and the wider technology community working together, is to close that gap and keep it closed.

At SmartSearch, that’s where we’re leading, where we’re investing, and where I expect the pace of change over the next five years to be faster than anything the compliance industry has seen before.