AI in banking: how a bank uses AI under the rules it answers to / Uses and their rules

Uses and their rules

AI for fraud and financial crime: deepfakes, monitoring and the rules for trying new tools

Criminals use AI to commit bank fraud, and banks use AI to find it. FinCEN's alert of 13 November 2024 describes criminals using generative AI to fake identity documents, photos and videos to open accounts, and lists nine warning signs. US agencies said in 2018 that a pilot of a new money laundering monitoring method should not by itself bring supervisory criticism, even if it fails. FinCEN proposed in April 2026 that responsible experimenting will not by itself add enforcement risk. This page gives each rule and its status as of 26 October 2026, and how to test a detection model.

Published October 26, 2026. Editorial.

Key takeaways

FinCEN's alert FIN-2024-Alert004 of 13 November 2024 lists nine warning signs of deepfake identity fraud, and says no single sign proves wrongdoing on its own.
The 2018 joint statement by the Fed, FDIC, FinCEN, NCUA and OCC says a pilot of a new anti-money laundering method should not by itself bring supervisory criticism, even if it fails.
FinCEN's proposal of 10 April 2026 names machine learning and generative AI among new approaches and requires no particular technology. As of 26 October 2026 it is still a proposal.
The 2021 statement on model risk for anti-money laundering systems (SR 21-8) was superseded on 17 April 2026, and the general model risk guidance now covers those models.
Reveneau's view: test a detection model on known cases, count both missed cases and false alerts, and keep the comparison with the old system in writing.

In the Bank of England and Financial Conduct Authority survey published on 21 November 2024, firms said the largest current benefits of AI are in "data and analytical insights, anti-money laundering (AML) and combating fraud, and cybersecurity" [11]. Anti-money laundering (AML) is the work of finding and reporting money that comes from crime. The same technology helps criminals. The Office of the Comptroller of the Currency (OCC) says AI makes it easier for attackers to start, and that banks can also use AI to defend against threats [9].

This page covers both sides: the AI-made fraud that US authorities have described, and the rules that apply when a bank uses AI to detect fraud and money laundering. It is part of the guide on AI in banking. Each status is as of 26 October 2026. Some of the documents below are law or proposed law, and some are guidance. A bank should confirm with its own counsel and examiners how each applies to it.

Deepfakes at account opening: FinCEN's alert

On 13 November 2024 the Financial Crimes Enforcement Network (FinCEN) issued alert FIN-2024-Alert004, "FinCEN Alert on Fraud Schemes Involving Deepfake Media" [1]. A deepfake is a photo, video or voice recording made or changed with AI to look real.

The alert says: "Beginning in 2023 and continuing in 2024, FinCEN has observed an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media in fraud schemes" [1]. It describes how "criminals have used GenAI to create falsified documents, photographs, and videos to circumvent financial institutions' customer identification and verification" [1]. Generative AI (GenAI) is AI that creates text, images, audio or video. Some of these attempts worked: "malicious actors have successfully opened accounts using fraudulent identities suspected to have been produced with GenAI" [1], and those accounts were used to receive and launder the proceeds of fraud [1].

The alert also describes criminals who "used GenAI tools to target companies by impersonating an executive or other trusted employee" [1], and scammers who "use deepfake voices or videos to impersonate a victim's family member, friend, or other trusted individual" [1].

FinCEN says "financial institutions often detect GenAI and synthetic content in identity documents by conducting re-reviews of a customer's account opening documents" [1]. It names multifactor authentication, which asks for two or more proofs of identity, and "live verification checks in which a customer is prompted to confirm their identity through audio or video" as helpful practices [1].

FinCEN's nine warning signs

FinCEN lists nine warning signs of deepfake fraud.

#	Warning sign, in FinCEN's alert [1]
1	The customer's photo looks altered, or does not match other identifying details
2	Several identity documents from the customer do not agree with each other
3	The customer uses a third-party webcam plugin, or changes channel during a live check
4	The customer declines to use multifactor authentication
5	A reverse image search, which looks for where else a photo appears online, matches the photo to a gallery of AI-made faces
6	Deepfake detection software flags a photo or video
7	Detection software flags text as AI-written
8	Location or device data does not match the identity documents
9	A new account shows rapid transactions, payments to risky payees, or many chargebacks (card payments that are reversed)

FinCEN adds that no single warning sign is necessarily a sign of illegal or suspicious activity on its own [1], so a bank should look at the signs together with other facts about the customer. It asks banks to use the term "FIN-2024-DEEPFAKEFRAUD" [1] in field 2 and in the narrative of a suspicious activity report (SAR), the report a bank files with FinCEN when it suspects a crime.

Voice checks carry a second risk. A report from Canada's Office of the Superintendent of Financial Institutions (OSFI) and the Financial Consumer Agency of Canada (FCAC) cites an outside figure: "Globally, 91% of financial institutions are rethinking their use of voice-verification due to AI voice-cloning" [10]. That figure comes from a source OSFI and FCAC cite, which this guide did not open.

Using AI to detect fraud and money laundering

The Financial Action Task Force (FATF) wrote in July 2021 that "Artificial intelligence (AI) and machine learning (ML) technology-based solutions applied to big data can strengthen ongoing monitoring and reporting of suspicious transactions" [6]. It also named the limits: "Difficulties with the explainability and interpretability of digital solutions are another key challenge for both industry and regulators" [6], and it said manual review and human input remain important [6]. Explainability is the ability to say why a model flagged a particular transaction.

The US Treasury's March 2024 report gives one firm's account. In Treasury's interviews, one large firm said AI models trained only on its own internal historical data "enabled it to reduce fraud activity by an estimated 50%" [7]. That is one unnamed firm's own estimate, reported by Treasury, so it describes that firm only. The same report found that "A clearinghouse for fraud data that allows rapid sharing of data and can support financial institutions of all sizes is currently not available" [7], as of March 2024.

Sharing has since been clarified. On 9 July 2026 the Federal Reserve passed on FinCEN guidance of June 2026 in SR 26-3, a supervision and regulation letter, which "clarifies the circumstances in which financial institutions (including Federal Reserve supervised banks) can share information regarding suspected fraud under section 314(b) of the USA PATRIOT Act" [8].

The rules for trying a new monitoring method

US agencies have said in writing how they treat a bank that tests AI in its AML program. On 3 December 2018 the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), FinCEN, the National Credit Union Administration (NCUA) and the OCC issued a joint statement on innovation in anti-money laundering. It says:

"pilot programs in and of themselves should not subject banks to supervisory criticism even if the pilot programs ultimately prove unsuccessful" [2].
If a new method finds activity the old one missed, "the Agencies will not automatically assume that the banks' existing processes are deficient" [2].
"The Agencies will not penalize or criticize banks that maintain effective BSA/AML compliance programs commensurate with their risk profiles but choose not to pursue innovative approaches" [2]. BSA is the Bank Secrecy Act.

The statement is still on the OCC's site as Bulletin 2018-44 with no note that it was rescinded [3], and FinCEN's 2026 proposal cites it [4].

On 10 April 2026 FinCEN proposed a rule on anti-money laundering and countering the financing of terrorism (AML/CFT) programs. It says: "Institutions that responsibly experiment with innovative technologies in their AML/CFT programs will not incur any additional risk of being subject to a significant supervisory AML/CFT action or AML/CFT enforcement action solely based on the use of innovative technologies" [4]. It lists "machine learning, generative artificial intelligence (GenAI), digital identity, blockchain monitoring and analytics, or application programming interfaces (APIs)" as examples [4]. It says "the proposed rule therefore does not reference or require the use of any particular technology" [4]. One factor FinCEN would consider before enforcement against a bank is whether the bank's innovative work shows that its program is effective, "(including effective use of artificial intelligence, federated learning, or other advanced monitoring tools)" [4]. Federated learning trains a model on data held by several organisations without moving that data to one place.

Document	Date	Status as of 26 October 2026	Kind
FinCEN FIN-2024-Alert004 on deepfakes	13 November 2024	Issued; no withdrawal found [1]	Alert
Joint Statement on Innovative Efforts (OCC Bulletin 2018-44)	3 December 2018	On the OCC site with no rescission note [3]	Guidance
FinCEN AML/CFT program rule	Proposed 10 April 2026	Comments closed 9 June 2026; not final [4]	Proposed rule
SR 21-8, model risk for BSA/AML systems	9 April 2021	Superseded 17 April 2026 [5]	Was guidance
SR 26-3 on fraud information sharing under section 314(b)	9 July 2026	Issued [8]	Guidance
FATF, new technologies for AML/CFT	July 2021	Published report [6]	International report

Model risk for monitoring models

In April 2021 the agencies issued a statement on model risk for systems that support Bank Secrecy Act and AML compliance. SR 26-2 lists it among the documents it supersedes: "SR letter 21-8, 'Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance' (April 9, 2021)" [5]. No separate replacement was issued, so the general model risk guidance of 17 April 2026 now covers those models. A machine learning model that scores transactions is inside that guidance, and a generative AI tool that drafts SAR narratives is outside it. The page model risk rules and AI explains the split.

In the EU, the AI Act lists credit scoring as high-risk "with the exception of AI systems used for the purpose of detecting financial fraud" [12], so a fraud detection model is outside that high-risk entry.

How to test a detection model

Reveneau's view is that a detection model has two ways to fail, and a test has to count both. It can miss a real case, and it can raise an alert on an honest customer. Each false alert costs staff time and can harm the customer. A useful test runs the model on a fixed set of past cases with known outcomes, counts the missed cases and the false alerts, and compares both counts with the system the bank uses today. Keep the comparison in writing. The 2018 statement says the agencies will not automatically assume the old system was deficient when a new one finds more [2], and a written comparison is how the bank shows what each system found.

For a generative AI tool that drafts SAR narratives or summarises cases, the test is an eval: a written, repeatable check of the tool's output against cases the bank chooses, with a person reviewing each draft before it is filed. The page running an AI pilot inside a bank covers the pilot itself, and the guide on AI agents in production covers tools that take actions on their own.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. To discuss a project, see Reveneau's services or contact Reveneau. For the vendor side of a monitoring tool, read AI vendor risk for banks.

Common questions

What did FinCEN warn banks about deepfakes?

FinCEN warned banks in alert FIN-2024-Alert004 of 13 November 2024 that criminals were using generative AI to fake identity documents, photos and videos to get past customer identification checks. It said suspicious activity reports describing deepfakes rose from 2023 into 2024, and that some accounts opened with suspected AI-made identities were used to receive and launder fraud proceeds.

How do banks detect deepfake identity documents?

Banks often detect deepfake identity documents by re-reviewing a customer's account opening documents, according to FinCEN's alert of 13 November 2024. FinCEN also names multifactor authentication and live checks, in which the customer confirms their identity through audio or video, as helpful practices. It lists nine warning signs, such as a customer who declines multifactor authentication.

Does one deepfake warning sign prove fraud?

One deepfake warning sign does not prove fraud on its own. FinCEN's alert of 13 November 2024 says no single sign is necessarily an indication of illegal or suspicious activity, so a bank should weigh the signs together with other facts about the customer and the account. The alert lists nine signs, from altered photos to rapid transactions in a new account.

What key term should a bank use in a deepfake suspicious activity report?

A bank should use the key term FIN-2024-DEEPFAKEFRAUD in a suspicious activity report about deepfake fraud, according to FinCEN's alert of 13 November 2024. FinCEN asks banks to put the term in field 2 of the report and in the narrative. The alert gives the term so that reports about deepfake fraud are marked the same way.

Will a failed AI anti-money laundering pilot bring criticism from examiners?

A failed AI anti-money laundering pilot should not by itself bring supervisory criticism, under the joint statement of 3 December 2018 by the Federal Reserve, FDIC, FinCEN, NCUA and OCC. The statement says pilot programs should not subject banks to criticism even if they prove unsuccessful. It is still on the OCC's site as Bulletin 2018-44 with no rescission note.

What if an AI monitoring system finds activity the old system missed?

If an AI monitoring system finds suspicious activity the old system missed, US agencies will not automatically assume the bank's existing processes were deficient, according to the 2018 Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing. A bank should still keep a written comparison of what each system found, so it can show examiners the results.

What does FinCEN's 2026 proposal say about AI in AML programs?

FinCEN's proposal of 10 April 2026 says institutions that responsibly experiment with new technology in their AML/CFT programs will not face added risk of enforcement solely because they use it. It names machine learning and generative AI as examples and requires no particular technology. As of 26 October 2026 it is still a proposal; comments closed on 9 June 2026.

Is SR 21-8 on anti-money laundering models still in force?

SR 21-8 no longer applies. The Federal Reserve's SR 26-2 of 17 April 2026 superseded it, along with SR 11-7, and the OCC and FDIC rescinded their matching documents the same day. No separate replacement for anti-money laundering models was issued, so the general 2026 model risk guidance now covers those models.

Is fraud detection AI high-risk under the EU AI Act?

Fraud detection AI is outside the EU AI Act's credit scoring entry. Annex III point 5(b) lists AI that evaluates the creditworthiness of people or sets their credit score as high-risk, with the exception of AI systems used to detect financial fraud. A bank should still check whether a fraud tool does any other task on the Act's high-risk list.

Can banks share fraud information with each other?

Banks can share information about suspected fraud with each other under section 314(b) of the USA PATRIOT Act, in the circumstances FinCEN clarified in guidance of June 2026. The Federal Reserve passed that guidance on to the banks it supervises in SR 26-3, dated 9 July 2026. In March 2024 the Treasury had found no fraud data clearinghouse serving banks of all sizes.

How should a bank test an AI fraud detection model?

A bank should test an AI fraud detection model on a fixed set of past cases with known outcomes, count both the missed cases and the false alerts, and compare both counts with its current system. Reveneau's view is to keep that comparison in writing with its date, because the 2018 joint statement accepts that a new method can find more than the old one.

References

More in Uses and their rules

AI in credit decisions and fair lending: reasons, the withdrawn circulars and the EU

A bank that uses AI to decide on credit must still tell each denied applicant the specific principal reasons for the decision. That duty is in Regulation B at 12 CFR 1002.9, and it is unchanged as of 26 October 2026. The CFPB's two circulars on AI and denial notices were withdrawn on 12 May 2025, and a CFPB rule effective 21 July 2026 says the Equal Credit Opportunity Act does not provide an effects test, a rule now challenged in court. In the EU, the Court of Justice held in 2023 that a credit score can itself be an automated decision. This page covers each.

AI in customer service for banks: chatbots, consumer law and the Air Canada case

A bank chatbot must comply with the same federal consumer financial laws as the processes it replaces, the CFPB said in its June 2023 report on chatbots. That report found that each of the ten largest US commercial banks used one, and this guide found no entry for it in the CFPB's May 2025 withdrawal notice. A 2024 tribunal ruling against Air Canada held a company responsible for what its chatbot told a customer. In the EU, Article 50 of the AI Act requires that people know they are talking to AI. This page sets out each, as of 26 October 2026.

Customer data, privacy and AI in banking: what a bank may send to an AI vendor

Before customer data goes into an AI system, a bank needs to know which rules cover it and what the AI vendor does with it. In the United States, the interagency information security guidelines require due diligence, contracts and, where the bank's risk assessment calls for it, monitoring of any service provider with access to customer information, and Regulation P limits sharing with outside companies. In the EU, the GDPR controls automated decisions and requires impact assessments. This page sets out those rules as of 26 October 2026, and what OpenAI, Anthropic, Google and Microsoft each say, on their own pages, about training, retention and data location.

Previous: AI in credit decisions and fair lending: reasons, the withdrawn circulars and the EU Next: AI in customer service for banks: chatbots, consumer law and the Air Canada case