Deepfake Detection for Periodic KYC Refresh and Risk Reassessment

Why periodic KYC refresh needs deepfake detection

Periodic KYC refresh is the point where a bank re-confirms who it is dealing with, and it is increasingly done remotely with a selfie, a video call or a document upload. That makes it a target in two ways. A fraudster who controls an account opened with a synthetic identity has to pass refresh to keep the account alive. A criminal who took over or bought a genuine customer's account has to pass it as someone they are not.

Refresh is also a chance to catch fraud that got through at onboarding. FinCEN's November 2024 alert states that financial institutions often detect generative AI and synthetic content in identity documents by re-reviewing a customer's account opening documents. Detection models improve over time, so a selfie that passed in 2023 may be flagged by a 2026 model. Re-screening stored media costs little compared with the losses from a mule account that stays open for years.

How often must KYC be refreshed?

Refresh frequency depends on the regulator and the customer's risk rating. India sets fixed maximum intervals; the United States sets a risk-based expectation. Most banks layer event-driven reviews on top of either.

Under the Reserve Bank of India's Master Direction on KYC, paragraph 38 requires periodic updation at least once every two years for high-risk customers, every eight years for medium-risk and every ten years for low-risk customers, counted from account opening or the last update. Paragraph 18 allows regulated entities to use Video-based Customer Identification Process (V-CIP) for updation and periodic updation of KYC for eligible customers, which puts a live video session, and its deepfake exposure, at the centre of refresh.

In the United States, FinCEN's CDD Final Rule requires covered institutions to conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. There is no fixed interval; the trigger is risk.

Event-driven triggers that should bring refresh forward

Calendar refresh catches slow problems. Event-driven refresh catches the accounts that are being abused now. FinCEN's alert lists indicators that warranted further due diligence on accounts already open, and several make good triggers for an early re-verification with a fresh selfie or video:

• Account access from an IP address inconsistent with the customer's profile.
• Patterns of coordinated activity among multiple similar accounts.
• High payment volumes to higher-risk payees such as gambling sites or digital asset exchanges.
• High volumes of chargebacks or rejected payments.
• Rapid transactions on a new account or one with little prior history.
• Withdrawing funds immediately after deposit in ways that are hard to reverse, such as international transfers.

A KYC refresh workflow with deepfake checks built in

The workflow below adds two detection steps to a standard refresh: one on the new capture and one on the archive. Run the archive step first where possible, because a flag on the original onboarding media changes how the new capture should be treated.

After the steps, update the customer's risk rating with the outcome. A clean refresh on a previously high-risk account may justify a lower rating; a manipulation flag on either capture should raise it and start an investigation.

• Re-screen the stored onboarding selfie and video with the current NeuroVerify model and record the new score next to the original result.
• Request a fresh selfie or liveness video, or run a V-CIP session where permitted, and analyse it for face swaps, generative artifacts and pixel-level edits.
• Compare the fresh face with the onboarding reference so a different real person fails the refresh.
• Check refreshed documents with your document verification vendor; NeuroVerify does not analyse ID documents.
• Combine the results with transaction monitoring alerts and the event triggers above, then route to clear, step-up or investigation.
• Record model version, policy version and reviewer notes so the reassessment can be audited.

Re-screening archived onboarding media at scale

Banks hold years of onboarding selfies captured before deepfake detection was part of the flow. Running that archive through current models is one of the cheapest ways to find dormant synthetic accounts, and it does not disturb customers unless something is flagged.

Prioritise by exposure: accounts opened remotely during periods of known attack activity, accounts with the event triggers above, and accounts that have never been refreshed. Keep the original image untouched, record which model version produced each new score, and send only high-risk results for review. Retention rules for biometric data still apply, so confirm the archive may lawfully be reprocessed for fraud prevention before starting.

How NeuroVerify supports refresh and reassessment

NeuroVerify analyses a face image, video or audio clip in one request across six signals, including Live Presence Verification, Face Manipulation Detection and AI Generative Model Analysis, and returns a unified risk score with signal-level evidence. Eligible image requests complete in under 200 ms p95 under defined test conditions, which suits both a live refresh session and high-volume archive re-screening through the backend SDKs for Python, TypeScript, Go and Java.

The models build on ARCAS 1B, Neural Defend's own detection model, and Neural Defend ranked first of 36 systems on the public VendorBench-100 still-image benchmark with an MCC of 0.876. When a refresh turns up a suspected synthetic account, analysts can open the media in NeuroDetect for region-level evidence and a forensic report. Deployment options include private cloud, on premises and air-gapped, which matters when archived biometrics cannot leave the bank's environment.