AI-driven identity fraud is forcing continuous KYC for crypto platforms

At a glance

What this is: This is a SumSub partner story about crypto identity fraud, arguing that AI-driven impersonation makes continuous KYC necessary across the user lifecycle.

Why it matters: For IAM and fraud teams, the key shift is that identity assurance in regulated digital assets now has to track changing risk after onboarding, not just at account creation.

By the numbers:

• Multi-step, resource-intensive fraud attacks powered by AI increased 180% year on year globally in 2025.
• MEXC serves more than 40 million users across 170+ markets.
• MEXC offers access to over 3,000 digital assets.

Context

Static KYC is a point-in-time control, but AI-assisted fraud now adapts faster than onboarding workflows can absorb. In crypto and other high-volume financial environments, the issue is not only whether an identity was verified at signup, but whether that identity remains trustworthy as behaviour, documents, and threat techniques change.

This article sits at the intersection of human identity, fraud prevention, and lifecycle governance. SumSub and MEXC frame continuous verification as a response to deepfakes, remote onboarding fraud, and increasingly scalable identity abuse, which means teams have to think beyond the initial proofing event.

The operational question for practitioners is how to preserve frictionless onboarding while tightening assurance across the session, account, and lifecycle states. That makes continuous KYC a governance pattern as much as a compliance control.

Key questions

Q: How should crypto platforms design onboarding so they can reduce friction without weakening identity assurance?

A: Crypto platforms should combine low-friction user flows with layered identity verification, rather than treating speed and security as competing goals. A strong onboarding design collects only what is needed, verifies documents and biometrics quickly, and uses liveness checks to reduce impersonation risk. The result is a faster account creation experience that still supports compliance and customer trust.

Q: Why do AI-driven fraud attacks bypass traditional KYC controls?

A: Traditional KYC controls are designed to verify a person once, not to prove that the same person is still present later. AI-driven fraud exploits that gap with synthetic identities, face swaps, and adaptive social engineering. The control failure is not identity collection, but the lack of runtime revalidation when risk changes.

Q: What are the warning signs that KYC is no longer enough?

A: The clearest signs are repeated identity changes, mismatched documents, unusual device or location shifts, and patterns that suggest the same fraud attempt is being adapted across accounts. When manual review volume keeps rising and fraud still gets through, the control is acting like a gate instead of an assurance process. That is a lifecycle problem, not just a tooling problem.

Q: Why do fraud and AML teams need to work from the same identity signals?

A: Because attackers use one identity path to achieve both fraud and laundering. If fraud teams see impersonation but AML teams see only transaction flow, each function detects too late. Shared identity and account telemetry creates a fuller chain of evidence, which is essential when money moves across borders faster than manual case handling can keep up.

Technical breakdown

Why static KYC breaks against AI-driven impersonation

Static KYC assumes the strongest verification moment is the first one. AI-generated deepfakes, forged documents, and synthetic identity artefacts undermine that model because the attacker can pass a single checkpoint while remaining untrusted over time. In practice, the control failure is not identity proofing itself, but the assumption that proofing once is enough for a living account in a changing threat environment. Behavioural drift, device changes, and document re-use all reduce the value of a one-time decision. For crypto platforms, that means onboarding and ongoing assurance need to be treated as one control plane rather than separate stages.

Practical implication: Treat onboarding as the start of assurance, not the end state.

How continuous KYC combines verification signals across the lifecycle

Continuous KYC is not just repeated document checks. It combines ID verification, biometric liveness, address validation, database checks, source-of-funds review, and risk-based workflow routing so that assurance can be updated when conditions change. The technical shift is from a static allow or deny decision to an adaptive identity posture that can re-score risk as new evidence appears. That makes the identity record more like a governed profile than a one-time file. For platforms with fast growth and large user bases, the architecture has to support incremental re-verification without making the experience unusable.

Practical implication: Design lifecycle triggers that can re-evaluate identity when risk signals change.

Why regulated crypto needs adaptive fraud controls, not just compliance checks

The article’s underlying point is that compliance and fraud defence now overlap. In regulated crypto, verification has to satisfy KYC and AML obligations while also resisting deepfake-led impersonation and remote onboarding abuse. That creates a dual requirement: controls must be strong enough to detect manipulated identity evidence, yet flexible enough to keep onboarding moving at scale. The technical consequence is that fraud controls, compliance workflows, and user lifecycle management can no longer be run as separate queues. They need shared signals, shared escalation paths, and shared accountability.

Practical implication: Unify fraud and compliance workflows around the same risk signals and review paths.

Threat narrative

Attacker objective: The attacker wants to establish a trusted account or relationship under false identity so financial crime can proceed inside a regulated platform.

1. Entry occurs when the attacker uses AI-generated deepfakes, forged documents, or other synthetic identity artefacts to pass onboarding checks.
2. Credential or account access follows when the platform accepts the identity as legitimate and opens a trading relationship or compliance record.
3. Impact occurs when the false identity is used to move funds, abuse the platform, or scale fraud across a large user base before detection.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Continuous identity assurance is now a fraud-control model, not a KYC enhancement. The article shows that one-time verification cannot absorb AI-driven impersonation, especially where attackers can iterate on documents, faces, and behavioural cues. In regulated crypto, the control boundary has shifted from onboarding to the full account lifecycle. Practitioners should treat continuous assurance as the baseline for high-risk digital asset operations.

Deepfake resistance is becoming a core identity governance requirement. Static proofing assumes the evidence presented at enrollment remains trustworthy long enough to justify downstream access. That assumption fails when synthetic media can be generated cheaply and used repeatedly across onboarding attempts. The implication is that governance now has to account for evidence integrity over time, not just identity attributes at the point of entry.

Continuous KYC creates a useful named concept: identity drift management. Identity drift occurs when the risk profile attached to an account changes after initial verification because documents, devices, behaviours, or funding patterns no longer match the original assurance state. The article’s model points toward ongoing re-assessment rather than fixed certification. Practitioners should manage identity as a moving posture, not a one-time verdict.

Crypto compliance is converging with fraud operations. The article describes AML, KYC, biometric checks, and source-of-funds review as part of the same defence pattern. That convergence matters because fraud teams and compliance teams often own different queues even when they are looking at the same signal. The practical consequence is that escalation design, not just control design, becomes a governance issue.

Scale changes the governance problem more than the technology stack does. The article ties the discussion to a large user base and a high-volume trading environment, which means manual review cannot remain the controlling assumption. Once user volume rises, assurance has to be selective, risk-based, and operationally continuous. Practitioners should expect lifecycle governance to become the limiting factor, not verification tooling alone.

From our research library:

• Veriff's 2026 Identity Fraud Report documented a 300X increase in digitally presented media that was either entirely AI-generated or otherwise altered.

What this signals

Identity drift management: Crypto platforms are moving toward a model where trust is recalculated whenever evidence changes, not just when a customer first signs up. That matters because AI-generated impersonation can remain invisible if governance only checks the identity at enrollment.

Practitioners should expect fraud controls, KYC operations, and lifecycle governance to converge into one operating model. The programme question is no longer whether verification exists, but whether it can keep pace with changing risk without breaking user experience.

For practitioners

• Map verification to lifecycle triggers Define when an account must be re-checked after onboarding, including device change, unusual funding behaviour, document mismatch, and high-risk transaction patterns.
• Add liveness and document-integrity checks Use biometric liveness, image analysis, and document authenticity checks together so deepfake impersonation does not bypass a single control.
• Unify KYC and AML escalation paths Route suspicious identity events into the same case workflow that handles AML and fraud review so risk signals are not split across teams.
• Define re-verification thresholds by risk Set clear thresholds for when a user session, account, or transaction profile requires step-up review, instead of relying on periodic checks alone.

Key takeaways

• AI-driven identity fraud is exposing the limits of static KYC across high-volume crypto environments.
• The article ties the risk to AI-enabled impersonation, remote onboarding fraud, and lifecycle-scale identity assurance.
• Continuous verification, shared fraud signals, and risk-based re-checks are the controls most likely to narrow the gap.

Key terms

• Continuous Identity Assessment: An approach that evaluates trust after onboarding, not only at account creation. It is especially relevant in marketplaces because risk shifts during recovery, payout changes, and high-value transactions, where a once-trusted identity may no longer deserve the same confidence.
• Deepfake-based impersonation: A fraud technique that uses synthetic audio, video, or both to make an attacker appear to be a trusted person during a live interaction. The tactic exploits human trust in familiar cues and often aims to trigger urgent actions such as payments, resets, or access changes before verification is challenged.
• Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
• Risk-Based Verification: A control approach that adjusts assurance strength to the context of the transaction, such as jurisdiction, wallet type, and value at stake. It avoids one-size-fits-all checks and lets firms apply stronger proof where the compliance and fraud risk is higher.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.