Cambridge’s 2026 global survey shows widespread AI adoption across financial-services risk and compliance functions, including fraud, credit risk, anti-money laundering (AML) and know your customer (KYC) work. Adoption does not prove effectiveness. FATF’s December 2025 horizon scan warned that deepfakes can circumvent customer due-diligence systems, including digital identity verification. A lender that onboards borrowers remotely therefore needs layered controls and a defined exception path.
Quick Answer
Automation reduces KYC and AML risk most in repetitive, rule-based work such as identity checks, sanctions screening, ongoing monitoring, and alert triage. It reduces risk least where judgment is needed, such as layered small and medium enterprise (SME) ownership and suspicious activity decisions. India, the US, and Canada all expect risk-based programs, and the US proposal focuses on effectiveness.
Key Takeaways
- Automation is well suited to repeatable identity, sanctions, watchlist, risk-scoring and re-screening steps.
- Human review remains important for conflicting identity signals, layered ownership, ambiguous matches and suspicious-activity decisions.
- Remote onboarding needs layered controls because deepfakes and synthetic identities can defeat a single biometric or document check.
- Lenders should test explainability, alert capacity, data quality, model governance and audit evidence before automating a control.
What KYC and AML Cover in a Digital Loan
KYC confirms who the borrower is. AML looks for signs that loan funds or repayments involve illicit money. Both rest on customer due diligence (CDD), which FATF Recommendation 10 sets out for financial institutions.
Those rules call for identification using reliable, independent data. The table maps each stage of a digital loan to what automation can handle and what still needs people.
| Stage | Automation handles | Still needs human judgment |
| Identity verification | Document checks, biometric matching, liveness detection | Conflicting signals or suspected deepfakes |
| Screening | Sanctions, politically exposed person (PEP), and watchlist matching at onboarding and when lists change | Ambiguous name matches |
| Risk rating | Applying the same risk factors to every applicant | Setting risk appetite and overriding ratings |
| SME ownership checks | Pulling registry data on owners | Layered or cross-border ownership |
| Ongoing monitoring | Flagging unusual account and payment activity | Deciding whether activity is suspicious |
| Reporting | Pre-filling case files and tracking deadlines | The decision to file |
What Regulators Expect in India, the US, and Canada
All three markets follow the FATF standards and expect a risk-based approach. The table shows where each stood in early October 2026.
| Market | Status | What it means for lenders |
| India | The Reserve Bank of India (RBI) issued KYC Directions for non-banking financial companies (NBFCs) on November 28, 2025, under the Prevention of Money Laundering Act. A December 2025 amendment covers reliance on the Central KYC Records Registry (CKYCR). | The Directions cover customer acceptance, identification, due diligence, record keeping, and reporting to India’s Financial Intelligence Unit (FIU-India). An NBFC can reuse a CKYCR record but keeps its other due diligence duties. |
| United States | April 2026 proposal from the Financial Crimes Enforcement Network (FinCEN) to reform AML program rules. Comments closed June 9, 2026. No final rule found. | The proposal focuses on whether programs are effective and carried out in practice. Technology is encouraged but not required. |
| Canada | The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has covered mortgage administrators, brokers, and lenders since October 11, 2024. FATF published Canada’s evaluation in late September 2026. | Mortgage lenders must verify identity, keep records, and report suspicious transactions. FATF’s roadmap calls for stronger risk-based supervision. |
Canada’s evaluation rated six of 11 effectiveness outcomes as substantial and five as moderate. Assessors found that a significant share of financial institutions and virtual asset service providers are not covered by an entity-level risk assessment.
They also found that supervision frequency does not always match assessed risk. Canada’s customer due diligence rules were rated largely compliant.
The FinCEN proposal covers 11 types of financial institutions, including loan or finance companies. It asks institutions to direct more attention to higher-risk customers than to lower-risk ones.
It also says institutions that responsibly use innovative tools will not face added risk of a significant supervisory or enforcement action solely for using them. Machine learning, generative AI, digital identity, and application programming interfaces (APIs) are among the tools it names. Risk assessments would need updating when an institution adopts new risk mitigation technology.
Why Remote Onboarding Raises the Stakes
Although published in December 2025, FATF’s horizon scan on AI and deepfakes is directly relevant to remote onboarding. It says deepfakes can circumvent CDD systems, including digital ID verification.
FATF names three amplifiers: growing reliance on biometric verification, AML systems that lag in detecting synthetic content, and cross-border complexity in remote identity checks.
One jurisdiction reported criminals merging stolen identity documents into hybrid synthetic identities. They used them to open bank accounts and bypass facial recognition.
The countermeasures FATF describes are layered. They include liveness checks that combine hardware, passive, and active methods, multi-factor authentication, and AI-driven detection in KYC.
FATF also lists behavioral red flags: rapid transactions to newly opened accounts, immediate withdrawals after deposits, and one device used by different counterparties. Lenders can test the same signals against loan applications and disbursal accounts.
Where Automation Reduces Risk
Cambridge’s report ranks AML and KYC (52%) behind fraud detection (57%) and credit risk and underwriting (54%) among risk and compliance uses. It lists AML anomaly detection as a typical use of classical machine learning.
Automation reduces risk when it does the following:
- Applies the same screening and risk rules to every applicant
- Re-checks customers when lists or risk profiles change
- Flags newly opened accounts, shared devices, and rapid fund movement
- Ranks alerts so analysts review the highest-risk cases first
- Keeps a record of each decision for examiners
Cambridge also found that some financial-services AI vendors market autonomous products, including transaction-monitoring and alert-triage tools. A regulated lender remains responsible for governance, validation, escalation and oversight even when a vendor describes a tool as autonomous.
Where Automation Adds Risk
Automation adds risk when it becomes the only control, when inputs are unreliable, or when the institution cannot explain and reproduce the result.
- Deepfakes and synthetic identities: FATF says detection techniques can quickly become obsolete. It stresses that human expertise can catch anomalies that automated systems may miss.
- Explainability: Cambridge found that 79% of surveyed regulators rate explainability as critical or important. Only 50% of industry respondents have adopted explainable AI methods.
- Data quality: Data availability and quality is the most cited adoption barrier, named by 40% of industry respondents.
- Model risk: FinCEN says it shares concerns that standard model risk guidance may be a poor fit for AML tools. It invites comment.
- Paper programs: FinCEN does not want programs that meet technical requirements without achieving results.
Evaluation Checklist: Is Your KYC and AML Automation Reducing Risk?
- Does onboarding combine document, biometric, and liveness checks with a second signal such as device or account data?
- Can the system screen applicants against sanctions and PEP lists at onboarding and when lists change?
- Does it reassess customer risk during the life of the loan?
- Can onboarding reuse a CKYCR record in India while still completing the other due diligence steps?
- Can analysts see why a case was flagged, in terms an examiner would accept?
- Is alert volume measured against analyst capacity before go-live?
- Is there a documented human review step for ambiguous or high-risk cases?
- Is the risk assessment updated when a new automated control is added?
Bottom Line
Automation can reduce KYC and AML risk by applying repeatable checks consistently and prioritising cases for analysts. It can add risk when it is the only defence against synthetic content or when decisions cannot be explained and reproduced. Lenders should retain human review for ambiguous and high-risk cases and document control performance in each market.
FAQs
What is the difference between KYC and AML in lending?
KYC identifies and verifies the borrower and sets a risk profile. AML is the wider program that screens, monitors, and reports suspicious activity. KYC is one part of CDD within AML.
Can lenders fully automate KYC?
No source reviewed requires it. FinCEN’s proposal says it does not require any particular technology. FATF’s case studies stress human expertise for anomalies that automated systems may miss. Lenders should keep human review for exceptions.
Do KYC and AML rules apply to non-bank lenders?
It depends on the market. RBI’s NBFC KYC Directions apply to NBFCs with a customer interface. FinCEN’s US program rules include a category for loan or finance companies. In Canada, mortgage lenders have been covered since October 2024. Lenders should confirm their status with counsel.
