AMLC is currently putting money into the use of AI as a means of combating financial crime. In August 2024, AMLC's Executive Director stated during a budget hearing before the Department of Finance that the Council was developing an AI system for detecting and monitoring AML issues, with an annual budget of over ₱50 million, expected to come into operation in early 2025. AMLC has also published a public advisory specifically concerned with investment scams enabled by deepfakes.
Neither of these actions introduces new binding rules requiring firms to detect deepfakes. The real change is in the threat model: FATF's own Horizon Scan on AI and deepfakes, approved at its October 2025 Plenary and published in December, found that synthetic audio, video, and images are now capable of convincingly impersonating individuals, bypassing KYC, remote onboarding, biometric verification, and liveness checks, controls that most institutions regard as a one-off barrier rather than something that has to be continuously monitored.
The way most KYC systems handle identity verification is to treat it as a single event: the customer provides a document, a selfie, and possibly goes through a liveness check, after which a decision is reached. This approach was designed with a threat model that didn't have access to generative AI in mind; it is now a less effective one.
FATF's Horizon Scan makes clear that deepfake technology is no longer a specialist capability. It is now possible to produce highly convincing synthetic video, audio, and images at low cost, so that even unsophisticated actors can launch high-impact scams. AMLC isn't a bystander here: it's already procuring its own AI capability for AML monitoring and has separately warned the public about deepfake-enabled investment scams. Both the threat and the regulatory response to it are genuine. What is not yet the case is a new binding Philippine rule that specifically requires deepfake detection, a distinction this piece treats as essential.
How AI-driven synthetic identities defeat traditional name screening
Traditional name screening compares a customer's stated identity, name, date of birth, nationality, and address, against watchlists and internal risk databases. It's designed to identify a real person with a flagged history, or a real person using a false name linked to a real and discoverable identity.
Synthetic identity fraud is different: it combines real, stolen, or partly fabricated data into a persona that doesn't fit neatly with any one actual person's background, meaning there's usually nothing on a sanctions or PEP list to compare it against. Generative AI has made this kind of fraud cheaper to run at scale, fabricated supporting documents, AI-generated profile pictures, and increasingly deepfake video or voice for the live checks required during onboarding.
The result is that a screening engine can function exactly as intended, finding no watchlist match, even while processing a persona deliberately constructed to have no match. The name screening process isn't flawed; it's simply answering a narrower question than the one the institution actually needs answered.
The name screening process isn't flawed — it's simply answering a narrower question than the one the institution actually needs answered.
Deepfake technology and video-based KYC vulnerabilities
FATF's Horizon Scan identifies the areas where deepfakes have real impact: remote onboarding, biometric verification, and liveness checks, the measures institutions have leaned on more heavily as onboarding shifted from branches to apps. The report cites an actual instance of deepfake securities fraud in which fabricated video of well-known news anchors was used to lend false credibility to a bogus IPO.
The real issue isn't that deepfakes can't be detected, detection tools exist and keep improving. The problem is the cycle: as detection improves, generated deepfakes improve to match it, which FATF specifically describes as a moving target rather than a fixed solution. Institutions that treat a deepfake detector bolted onto onboarding as a finished project are only defending against today's deepfakes, not next year's.
FATF's own recommendation reflects that: a layered approach, not a single control, tools that detect audio and video inconsistencies, enhanced multi-layer verification, and human reviewers trained to recognize manipulation patterns, used together rather than any one being treated as sufficient on its own, a framing independently corroborated by Lexology's analysis of the Horizon Scan.
What AMLC is actually doing (and not claiming)
Two verifiable facts, and one important limit on how to read them.
First, in August 2024, AMLC Executive Director Matthew M. David told a Department of Finance budget hearing that AMLC was developing its own AI system for AML detection and monitoring, in partnership with a local IT firm, with an annual subscription budgeted above ₱50 million, the largest line item in AMLC's ICT budget. David said the system was expected to be completed by end-2024 and operational in early 2025, explicitly framed as part of AMLC's response to the FATF grey-listing action plan.
Second, AMLC has published a public advisory specifically addressing deepfake-enabled investment scams, warning the public about fraudulent schemes that use deepfake technology to impersonate credible figures. That advisory didn't emerge from an abstract concern: in October 2025, Philippine authorities arrested two suspects in Pampanga over an investment scam that used a manipulated video of President Ferdinand Marcos Jr. to convince a physician to invest ₱93 million over the course of a year. It's worth being precise about what kind of deepfake threat that case represents: it's social engineering, a victim persuaded to invest through a fabricated endorsement, not an institution's onboarding controls being bypassed. Both are deepfake-enabled financial crime, and both eventually touch the same financial system AML controls are meant to monitor, but they're different mechanisms worth keeping separate when thinking through which controls address which threat.
October 2025 — a deepfake video of President Ferdinand Marcos Jr. convinced a physician to invest ₱93 million into a fraudulent scheme over the course of a year. Two suspects were later arrested in Pampanga.
Neither is a new regulatory requirement imposed on covered institutions. The AI system David described is an internal detection and monitoring tool built by AMLC, not a mandate for how covered persons must screen customers. The advisory is outward-facing public guidance, not a binding technical standard. What both signal, together, is that the regulator responsible for the Philippines' next FATF mutual evaluation, due in 2027, treats AI-enabled financial crime as a current issue, not a hypothetical one. Institutions waiting for a specific circular before adjusting their own controls are reading that signal one step too literally.
Building AI-resilient compliance systems
"AI-resilient" doesn't need to mean winning an arms race against generative AI, and for most organizations that goal isn't realistic. A more sustainable approach doesn't try to catch every deepfake at the point of entry; it's designed so that one successful deception at onboarding isn't the end of the story.
An artificial identity that passed onboarding once doesn't automatically pass a later review. Continuously screening the existing customer base against new watchlist and adverse-media entries, rather than only at onboarding, surfaces identities that looked clean on day one and stopped being clean afterward.
Whenever a screening match does or doesn't occur, the analyst should see exactly which fields matched and at what confidence, a name match at 67%, a date of birth match at 100%. That gives the analyst something concrete to investigate rather than a black-box pass/fail, and it's the same explainability an institution needs when a regulator asks how a case was handled.
When sensitivity or field weighting is adjusted in response to a new fraud pattern, the institution needs to see who changed it, when, and from what setting, without reconstructing it after the fact. Institutions that can't produce that quickly can't demonstrate their controls kept pace with the threat, even if they actually did.
Closing the gap
FT AML Solution's Name Screening module is built on this same principle: a real-time API check compares five identity fields, name, date of birth, gender, citizenship, and address, against roughly six million watchlist entries, including AMLC's watchlist, UN sanctions, PEP databases, and adverse media, before onboarding completes. Every match is explainable at the individual field level, and weightings can be adjusted directly in the platform rather than through an engineering ticket.
Against a synthetic-identity threat model, what matters most is what happens after onboarding. Delta Screening continuously checks the existing customer base against new watchlist entries since the last run, so an identity that passed once doesn't stay unexamined forever. Every configuration change, matching-rule adjustment, and rescreening result is recorded in a native audit trail viewable without manual reconstruction.
FT AML Solution doesn't claim to detect deepfakes, no screening system honestly can right now, and any vendor suggesting otherwise is overstating FATF's own read on the pace of that arms race. The solution is built so an institution's controls don't depend on one moment being correct.