How effective is AML if ultimate beneficial owners (UBOs) are no longer human?
The existence of ultimate beneficial ownership (UBO) registers gives the impression that a single human can be discovered behind any company. That assumption breaks down once ultimate beneficial owners can be synthetic.
While adopting centralised frameworks to identify a business’s key beneficiary (or beneficiaries) remains slow globally, criminals have been working underground to stay ahead of regulators.
Now, the traditional threats of shell companies or nominee directors are intermingled with synthetic identities and documentation, created simply using generative AI.
UBO investigation has to change before it has properly begun. Fabricated persons can be reused across the financial system, which weakens international anti-money laundering (AML) efforts and lets fraud scale.
How UBO verification was meant to work
In South Africa, a beneficial owner is a natural person who ultimately owns or exercises effective control over a company. For disclosure purposes, the Companies and Intellectual Property Commission (CIPC) applies a 5%-and-above shareholding or voting-rights threshold. A framework for spotting beneficial owners analyses business structures and follows each layer to the person in control.
AML is only as effective as the identity checks behind each beneficial owner. When a UBO can be generated with AI, institutions need biometric verification at onboarding and continuous risk rescoring after it.
As the Financial Intelligence Centre Act (FICA) makes clear, accountable institutions are obliged to identify and verify the beneficial owners of their clients, while separately, companies and close corporations themselves must submit their own beneficial ownership information to CIPC’s national register, set up in 2023. Telling a real beneficial owner apart from a convenient stand-in is often left to the institution’s own judgement.
Criminal UBOs stay one step ahead. Globally, UBO registers and databases also face data privacy disputes over how to supervise and share that information across borders.
Even in less severe cases of UBOs being involved with laundering, terrorist financing, trafficking, embezzlement, or racketeering, some cover their tracks to avoid having to be transparent about unpaid taxes.
Legitimate corporate structures can put authorities off the scent by being complex, while shell companies give the impression of legitimacy to funnel illicit funds around the globe. Each layer makes a wrongdoing UBO harder to identify.
As a result, UBO registers can still give organised crime leaders, politically exposed persons (PEPs) and sanctioned individuals somewhere to hide.
Deepfake KYC: how synthetic identities beat identity verification
These problems are long-standing, and they still block institutions tasked with UBO verification, a step that onboarding and due diligence depend on throughout know your customer (KYC) and AML checks.
Finding a real UBO at the end of a paper trail is now in question, because AI has made synthetic identities cheap to produce at scale. Synthetic identity fraud has been described as the fastest-growing form of identity theft, with over 80% of new account fraud attributed to it, according to Thomson Reuters (2023).
In South Africa, traditional document fraud fell by 73% in the first quarter of 2025, while synthetic identity fraud surged 153% year on year.
AI-based deepfakes now let even lone fraudsters defeat KYC checks. Tools to replace actors’ facial profiles, manipulate expressive facial and bodily movements and generate synthetic audio tracks have been democratised: cheap, accessible, and powerful enough to bypass biometric verification methods.
More advanced is the ‘injection’ technique, where criminals can intercept APIs and insert any manipulated images or videos directly into an institution’s identity verification (IDV) system.
This all leads to the rapid expansion of fraud conducted by highly organised fraud rings. Deepfakes can create wholly made-up personas using real data that has been harvested on digital channels (where full ‘identity kits’ are also traded on dark web marketplaces).
How synthetic identity fraud scales through fake UBOs
In July 2018, the Financial Action Task Force (FATF) and the Egmont Group listed falsifying activities among the techniques used to obscure beneficial ownership. Generative AI now produces legitimate-looking documentation on demand, which makes those techniques faster to repeat.
Synthetic documentation becomes another crutch for a similarly synthetic identity to appear plausible. The face of a relatively ‘real’ human backed up by passports, South African ID numbers, and proof of address can be enough to satisfy regulators’ current UBO disclosure requirements.
Plus, any supporting documents required to obtain insight into a more difficult ownership structure can equally be fabricated as AI-generated trust deeds, partnership agreements, or organograms.
Traditional IDV processes, registry checks, and PEP and sanctions screening may catch a forged document, yet they still assume a real person stands behind it. That assumption is the harder problem to solve.
In fact, a synthetic UBO that one institution cannot detect can be reused across many ownership structures, companies and jurisdictions. Firms with no visibility into each other’s fraud patterns will not catch the repetition.
Left to carry on this way, UBO registers can become libraries of synthesised identities, leaving nationwide IDV frameworks unable to maintain control over financial crime.
Why dynamic risk scoring makes the difference
Stopping synthetic identities at the source lets legitimate customers and partners through know your business (KYB) and KYC checks, and regulatory technology (RegTech) is built for that job.
UBO declarations at the point of registration should be backed up with biometric IDV as a standard. This covers document screening as well as liveness checks, which verify real people using subtle facial cues, audio and fingerprints, and by scanning micro-movements, background lighting anomalies and skin textures.
Where advanced IDV checks are run, they may well be run once at the initial KYC stage, then forgotten. However, this compounds the UBO problem if an identity is a construction and if an ownership structure shifts over time.
As perpetual KYC is becoming a necessary risk-based task, UBO verification should also evolve away from static systems toward a continuous cycle of detection whenever a UBO risk signal is raised – and rescoring an entity based on its level of risk.
The following underpins a dynamic response to criminals continually looking for the next opportunity to exploit AI-generated synthetic identities:
- Behavioural anomalies: dynamic risk scoring can identify any strange customer attributes or transactions according to their risk thresholds and historical patterns.
- Structural changes: an AML platform should react to any alterations in organisational structures and re-score the entity against the raised risk level.
- Audit trail: capturing information on related parties and business relationships creates data-based evidence for any supervisory checks, and maintains integrity around an institution’s ability to account for shifting risk scores.
What beneficial ownership verification needs next
For UBO registers in South Africa and beyond to become as effective as they are intended to be, every accountable institution, the FIC, and FATF must give greater weight to dynamic risk assessments through an AML process.
Then, through greater cross-border regulatory oversight, intelligence can be shared and cross-referenced with wider networks acting against financial criminals, whether they are real or synthetic.
Under current UBO frameworks, it is getting harder to pin down who controls a business. Institutions need infrastructure built to catch synthetic identities, and the problem becomes solvable once the anti-financial crime ecosystem treats synthetic identity as a baseline assumption.
To see how continuous UBO verification and risk rescoring work in practice, arrange a demo.
