Two regulators have moved on AI-generated identity fraud since July, and they have not moved the same way. The Gambling Commission’s 2026 money laundering and terrorist financing risk assessment puts false or AI-generated identity documents at the top of its scale for remote casino, and says nothing at all about which verification method an operator should use. The European Union’s anti-money laundering authority has gone the other way and drafted standards that rank the methods, so an operator verifying a customer from a document rather than an electronic ID will have to explain why. If you run remote onboarding into both, the job for the rest of this year is getting the capture path and the written record into a state that answers either question.
Key Takeaways
- The Gambling Commission’s 2026 money laundering and terrorist financing risk assessment, published on 30 July 2026, rates false or stolen identity documentation, including AI-generated documents and videos, at 9 out of 9 in its remote casino chapter, and adds a new 9 out of 9 risk for inadequate due diligence on customers who are not physically present for verification. Eleven of the 32 risks in that table now score at the maximum. (1)
- The European Union’s Anti-Money Laundering Authority finalised its draft customer due diligence standards under Article 28(1) of Regulation (EU) 2024/1624 on 30 September 2026 and announced them on 1 October. Article 7 of the draft permits verification from an identity document only where the customer cannot reasonably be expected to present one in a face-to-face context and has no access to qualifying electronic identification, and Article 7(3) requires the operator to be able to justify why electronic identification was not used. (2) (3)
- Camera injection, which feeds a prepared video stream past the device camera instead of holding a fake up to it, is the attack the new wording describes without naming. iProov recorded a 741 per cent rise in injection attacks across 2025, with attacks on iOS up 1,151 per cent in the second half of the year, and the World Economic Forum’s Cybercrime Atlas found injection tools selling for between roughly $10 and $3,000. (4) (5)
What has actually changed about AI-generated KYC fraud?
The attack has moved from the document to the camera path, and the rules have started following it. For most of the last decade the fraud an operator was buying protection against was presentation: someone holds a forged passport or a printed face up to a phone, and the verification tool decides whether what it can see is real. Injection skips that step entirely by feeding a prepared video stream into the verification session as though it had come from the camera, either through the app, through a system-level virtual camera driver, or on a rooted or jailbroken handset.
iProov recorded a 741 per cent rise in injection attacks across 2025, with attacks on iOS up 14 per cent in the first half of the year and 1,151 per cent in the second. (4) Entrust, working from more than a billion verifications across 195 countries between September 2024 and September 2025, found digital forgeries had risen to 35 per cent of document fraud against a 29 per cent average for 2022 to 2024, with deepfakes behind one in five biometric fraud attempts and injection attacks up 40 per cent year on year. (6)
The World Economic Forum’s Cybercrime Atlas went and assessed the tools themselves, with research led by Banco Santander and Group-IB, and those findings are more useful than any growth rate. Of 25 tools collected between July 2024 and April 2025, 17 did face swapping and eight did camera injection, four of them at application level and three through system-level virtual camera drivers, with prices running from roughly $10 to $3,000. Only five managed genuine real-time face swapping, so the capability is still uneven. The study also names gambling, alongside telecommunications and trading, as the industries being targeted next, because they depend on the same checks as banking without always having bought the same defences. (5)
What should an operator do in the next 30 days?
Five things, in this order, because each one feeds the next.
- Establish whether your verification captures from the device’s own camera. Log virtual camera sources and any mid-session change of device, then decide now, rather than during an incident, whether a virtual camera blocks the attempt or sends it to manual review.
- Find out which stream your supplier scores. Where the scoring happens on the handset against the local preview, the attack arrives downstream of the detection, and the fix is an integration change rather than a setting.
- Write down the stop conditions. The AMLA draft requires an alternative verification process to stop where there are technical shortcomings, interruptions to the connection or doubt about the person’s identity, so name those conditions, name who hears about it when one of them occurs, and record what happens to the attempt afterwards. (2)
- Pull 12 months of verification failures and sort them by reason. If none of them is recorded as suspected synthetic media, that is a detection and recording problem rather than good news, since Entrust’s own figure puts deepfakes behind one in five biometric fraud attempts. (6)
- Check what the record keeps. Article 7(2) of the draft wants time-stamped records held securely enough that the check can be examined after the event, which is a different requirement from keeping the pass or fail result. (2)
Where does the new standard contradict what operators already bought?
Most remote onboarding stacks were bought to answer a question the draft standard does not ask. The purchase decision was usually framed around document fraud detection rates and pass rates, while the standard is framed around whether the person presenting the document is its holder, whether the integrity and confidentiality of the channel held, and whether the images were good enough to identify someone unambiguously. Those are control objectives rather than products. A supervisor asking about them wants evidence, not the name of a product.
Neither the word liveness nor the phrase injection attack appears anywhere in the AMLA draft. (2) Anyone going looking for the clause that mandates a particular defence will not find one. No supplier can be bought to discharge the duty, and none can be blamed for not having been named in it.
The electronic identification route is not a clean escape either. A wallet at high assurance moves the problem of binding a credential to a real person onto the wallet issuer, which is a better place for that problem to live, and the draft accepts electronic identification means at substantial or high assurance whether or not they have been notified, European Digital Identity Wallets included. (2) It does nothing for the customer who has no wallet, and under the draft that customer is precisely the one whose document check has to be justified, so the document path has to get better at the point it becomes the exception.
There is also a scoping question underneath all of this that nobody has answered in print. Article 5f(2) of Regulation (EU) 2024/1183 requires private relying parties that are obliged by law or by contract to use strong user authentication for online identification to accept the European Digital Identity Wallet by 24 December 2027, and the sectors it lists, among them banking, financial services, health, education and telecommunications, are introduced with the word including rather than forming a closed list. (7) Gambling is not named. Licensed operators are nonetheless required by law to identify their customers, which is the test the article sets. So an operator licensed in an EU market has an opinion to commission rather than an answer to look up, and that opinion decides whether wallet acceptance is a project for 2027 or nothing at all.
What should be built before the EU standards apply?
One remote onboarding evidence file per licence, kept current rather than assembled when somebody asks for it. Each file holds:
- the verification methods that market’s law actually recognises, with the instrument named, and whether an electronic identification route exists there at substantial or high assurance
- whether capture runs from the device’s own camera, how a virtual camera source is detected, and whether detection blocks the attempt or escalates it
- the stop conditions in writing, the named person who hears about a stop, and what becomes of the attempt
- 12 months of verification volumes split by method, with failure reasons, and the share of failures attributed to suspected synthetic media
- where the time-stamped record of each verification sits, for how long, and whether it can be replayed to a supervisor
- for every market where you verify from documents rather than electronic identification, a dated written reason approved by a named person, because that is the document Article 7(3) will ask for
- the date the file was last refreshed, and whose name is against it
The sixth item is the one most operators do not have. It is also the cheapest to produce now and the most awkward to produce later, because a justification written after a supervisor has asked for it reads exactly like what it is.
How do Great Britain, the European Union and Ontario compare?
Great Britain and Ontario tell an operator what verification has to achieve, while the European Union is moving to tell it which method to reach for first. That difference is why the evidence file has to sit per licence rather than per group.
| Market | Instrument and date | What it fixes | What the operator has to prove |
| Great Britain | Gambling Commission, 2026 money laundering and terrorist financing risk assessment, 30 July 2026 | Risk ratings only, with no method prescribed | That due diligence is adequate against two risks the regulator scores at 9 out of 9 |
| European Union | Regulation (EU) 2024/1624, Article 22(6), applying from 10 July 2027, with AMLA draft standards finalised 30 September 2026 | Ranks the methods and puts electronic identification first | Why electronic identification was not used, in writing, to its supervisor |
| European Union, separately | Regulation (EU) 2024/1183, Articles 5a(1) and 5f(2), wallets available by 24 December 2026 and acceptance by 24 December 2027 | Supplies a high-assurance method and obliges some private parties to accept it | Whether gambling sits inside the Article 5f(2) class at all |
| Ontario | AGCO Registrar’s Standards for Internet Gaming, Standards 3.04, 3.05 and 3.12 | Outcome only: player information complete, accurate and validated before an account is created | That validation happened before account creation and the player was authenticated before gambling |
A group holding both a British licence and an EU one has the harder version of this, because the British assessment rates the risk at the top of its scale without naming a method, while the EU standard will expect the method and a written reason for any departure from it. One onboarding process serving both licences has to carry the evidence for both, which is a documentation job more than a technology one. Ontario is the reminder that an outcome-only standard is not a lighter standard, since Standard 3.04 requires player information to be complete, accurate and validated before the account exists, and an injected stream that passes verification defeats that wording as surely as it defeats the other two. (8)
Boardroom Questions
- Which of our licensed markets recognise an electronic identification route today, and in which of them are we still verifying from documents by choice rather than by necessity?
- If a supervisor asked us tomorrow to justify using a document instead of electronic identification for a named customer, who writes that answer, and what does it draw on?
- Does our verification score the stream our servers receive or the preview on the customer’s handset, and which of our suppliers will answer that in writing?
- How many verification failures in the last 12 months did we attribute to synthetic media, and if the answer is none, how do we know that is true?
- Are we inside the class of private relying parties that Article 5f(2) obliges to accept the European Digital Identity Wallet by 24 December 2027, and who has been asked for an opinion on it?
- What happens to a customer whose onboarding we stop because of a technical fault, and does anyone review those cases for a pattern?
Sources
1. Gambling Commission, The 2026 money laundering and terrorist financing risks within the British gambling industry, remote casino risks and ratings chapter, published 30 July 2026, gamblingcommission.gov.uk. Rates lack of adequate due diligence on customers not physically present for verification at High (9), recorded as a new risk, and false or stolen identity documentation including the use of AI tools to generate documents or videos at High (9), recorded as existing wording revised. Eleven of the 32 risks in the chapter’s risk table are rated High (9). The chapter states that the Commission is aware of an increase in the scale and sophistication of attempts to bypass customer due diligence checks using false documentation, deepfake videos and face swaps generated by AI.
2. Anti-Money Laundering Authority, Final Report on the draft Regulatory Technical Standards under Article 28(1) of Regulation (EU) 2024/1624, dated 30 September 2026 and announced on 1 October 2026, amla.europa.eu. Article 6(4) and Recital 11 recognise electronic identification means at substantial or high assurance, whether or not notified, including European Digital Identity Wallets. Article 7(1) permits an alternative where the person cannot reasonably be expected to submit an identity document, passport or equivalent in a face-to-face context and has no access to qualifying electronic identification means. Article 7(2) requires reliable and independent sources plus safeguards covering controls that the natural person presenting the document is its holder, the integrity and confidentiality of the communication channel, images and data of sufficient quality to identify the person unambiguously, stopping the process on technical shortcomings, connection interruptions or doubts about identity, and retained, time-stamped and securely stored records allowing verification after the event. Article 7(3) requires obliged entities to be able to justify why the customer could not be verified by the Article 22(6) methods and to demonstrate compliance to their supervisor. Neither liveness detection nor injection attacks are mentioned in the text.
3. Regulation (EU) 2024/1624 (the Anti-Money Laundering Regulation), applying from 10 July 2027, eur-lex.europa.eu. Article 3(3)(g) lists providers of gambling services as obliged entities, Article 4 provides for member state exemptions for certain providers of gambling services, and Article 22(6) permits verification by means of an identity document, passport or equivalent, or by electronic identification means meeting the substantial or high assurance levels set under Regulation (EU) No 910/2014.
4. iProov, 2026 Threat Intelligence Report, published 8 April 2026, iproov.com. Injection attacks up 741 per cent across 2025; iOS injection attacks up 14 per cent in the first half of 2025 and 1,151 per cent in the second half against the same period of 2024; attacks in South East Asia up 720 per cent in the third quarter of 2025, with virtual camera attacks named as a technique in use there.
5. World Economic Forum Cybercrime Atlas, Unmasking Cybercrime: Strengthening Digital Identity Verification against Deepfakes, January 2026, research led by Banco Santander and Group-IB, with contributions from Mastercard, Recorded Future, SpyCloud, Trend Micro and Lemon, reports.weforum.org. Assessment of 17 face-swapping tools and 8 camera injection tools collected between 1 July 2024 and 30 April 2025: five with genuine real-time face swapping, three of those offering virtual camera or equivalent injection paths, four using application-level injection, three using system-level virtual camera drivers, four requiring root or jailbreak access, and prices from roughly $10 to $3,000. Names gambling, telecommunications and trading as KYC-dependent industries increasingly targeted. Recommends verifying the camera path, flagging virtual cameras and mid-session device changes, randomised dynamic liveness prompts, and scoring the delivered compressed stream rather than the local preview.
6. Entrust, 2026 Identity Fraud Report, published 18 November 2025, entrust.com. Drawn from more than a billion verifications across 195 countries between September 2024 and September 2025. Deepfakes linked to one in five biometric fraud attempts, deepfaked selfies up 58 per cent in 2025, injection attacks up 40 per cent year on year, digital document forgeries at 35 per cent of document fraud against a 29 per cent average for 2022 to 2024, physical counterfeits at 47 per cent, and national identity cards accounting for 46 per cent of fraudulent document submissions globally.
7. Regulation (EU) 2024/1183 (the European Digital Identity Framework, amending Regulation (EU) No 910/2014), eur-lex.europa.eu. Article 5a(1) requires each member state to provide at least one European Digital Identity Wallet within 24 months of entry into force of the relevant implementing acts, which were in force from 24 December 2024, giving a date of 24 December 2026. Article 5f(2) requires private relying parties that are required by law or by contractual obligation to use strong user authentication for online identification to accept the wallet, on the voluntary request of the user, no later than 36 months from that date, giving 24 December 2027. The sectors listed are introduced by the word including and cover transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications. Gambling is not named.
8. Alcohol and Gaming Commission of Ontario, Registrar’s Standards for Internet Gaming, agco.ca. Standard 3.04 requires player information to be complete, accurate and validated before a player account is created, covering name, date of birth, address, login identifier, contact information and the information required under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Standard 3.05 requires players to affirm the accuracy of that information before an account is created. Standard 3.12 requires all players to be authenticated before accessing their account and being permitted to gamble, with multi-factor authentication offered at login.