Crypto KYC vs. Other Sectors: What Research Reveals About AI Fraud Readiness

In Regula’s recent research, 44% of Crypto respondents reported participation of AI automation in identity checks (confirmed through later case review), compared with 31% of peers. 

That does not necessarily mean Crypto faces more automated activity; rather it speaks to how well teams are able to investigate the chain of events post-identity verification — and detect this activity.

At the same time, even in the age of AI, document fraud remains the top identity threat for crypto companies. It was selected by 44% of respondents, ahead of deepfake impersonation at 37% in second place.

In this article, we look at what those findings mean for crypto KYC: verifying documents and their holders, investigating suspected manipulation, and using decision records to test improvements to future checks.

Document fraud leads the Crypto concern list, ahead of deepfake or AI-generated impersonation at 37%, stolen identity media at 35%, and AI agents or automated systems at 27%. Crypto also records the highest observed document-fraud response among the six industries, although Government is very close.

It’s worth paying attention to the form of the answer, as “counterfeit, altered, or stolen documents” brings several very different identity problems under one heading.

A counterfeit document is false evidence made to look like a document issued by a legitimate authority. With an altered document, the underlying document may be genuine, but somebody has changed information or other elements (e.g., a photo) afterward. In both cases, the immediate question is document authenticity.

A stolen genuine document creates a different problem. The layout can be correct, its security features genuine, its data internally consistent, and its RFID chip valid. Document authentication may therefore succeed exactly as intended. The unresolved question is whether the person presenting it has any right to use it.

That is also where AI can become part of an otherwise traditional document-fraud attempt. Generated, manipulated, or prerecorded biometric media may help an impostor resemble the legitimate holder during remote verification.

So the 44% result does not suggest that Crypto somehow failed to move on from counterfeiting. The document remains a strong identity anchor, while fraud can target either the document itself or the connection between that document and its rightful holder.

It is therefore important to treat document authenticity and holder verification as connected parts of the same identity decision, while still asking each check to prove something specific.

Document authentication goes much further than reading the name, date of birth, and document number correctly. A strong check identifies the document type and version, examines available security features, and compares information stored in different document elements. A counterfeit can contain perfectly readable personal data, so accurate extraction alone says little about authenticity.

When an electronic document and the user’s device support it, NFC verification adds particularly strong issuer-backed evidence. Reading the RFID chip and checking cryptographically signed data can provide issuer-backed evidence that is unavailable from an image alone.

But that is still only the document checked. Next comes the holder.

Now is the time to establish whether the person in the session is the person the document belongs to. Face matching contributes to that comparison, while liveness and capture-integrity checks help establish whether a real person is present and whether the biometric media reached the verifier through the expected capture source.

Crypto has the highest observed confirmed-case response among all six industries. 

In our context, “confirmed” means: AI-assisted or automated actors attempted to interact with identity processes — and the team confirmed that fact through investigation or post-incident review.

That does not mean 44% of Crypto respondents reported a successful AI fraud attack. Nor does it mean that every confirmed case involved a deepfake. The survey answer covers AI-assisted or automated activity, including: 

• A script or automated tool interacting with an identity verification flow

• An AI assistant or agent carrying out parts of the interaction on a user’s behalf

• Automated behavior detected in the flow even when the organization cannot confidently attribute it to AI

And this result becomes more interesting once we look at the other answers to the same survey question.

Crypto and its peers look remarkably similar on three of the four answers shown here. Still, the pattern does not support a story in which Crypto respondents report more AI-related experience on every measure.

So why do more Crypto respondents report confirmed AI activity cases? We honestly cannot say for sure.

Crypto organizations may encounter a different mix of automated abuse. They may investigate suspicious identity events more deeply. They may also use different thresholds before calling a case confirmed. Most likely, several factors contribute.

Crypto’s strong traceability result, which we come to next, makes deeper investigative capability one plausible part of that explanation. The available data does not establish that relationship within the Crypto sample itself, so it should remain exactly that: a plausible explanation.

That means the original session needs to leave enough usable evidence behind for an investigation to revisit it. Depending on the organization’s retention rules, that may include document verification, biometric results, capture-integrity findings, device and session data, the rule and model versions active at the time, and any reviewer actions.

A broad label such as “AI fraud” is rarely enough to tell the team what needs changing. The investigation needs to establish what actually happened during the identity check and how the verification process handled it.

For example, a synthetic-media alert may justify investigating whether the submitted face was generated or manipulated. A virtual-camera signal may justify checking whether the expected camera feed was replaced. Neither signal, on its own, establishes the full incident.

Once the failure is established, it points back to a much more specific part of the verification process:

• An altered document was accepted: Review the document-authentication findings and whether the decision logic ignored an authenticity warning.

• A genuine ID was accepted for an impostor: Review the document-holder comparison, biometric evidence, and any reviewer decision that allowed the case through.

• Prepared media replaced the intended camera input: Review the capture-integrity controls and whether the substitution was detected and acted on.

• The evidence remains inconclusive: Keep the case classified as suspected instead of turning uncertainty into a confirmed fraud finding.

This is Crypto’s clearest reported capability advantage in the research. More specifically, Crypto has the highest observed share among all six industries selecting the strongest answer on full decision reconstruction.

Still, it gives the confirmed-AI result some useful context. In the full survey sample, confirmed AI-assisted or automated cases are reported by 36% of respondents with fully reconstructable decisions, compared with 25% of those with limited or unavailable reconstruction.

That does not prove that stronger traceability caused Crypto’s higher confirmed-case response. The comparison covers the full sample, not Crypto alone. One possible explanation is that when investigators can recover the evidence, rules, system findings, and reviewer actions behind a decision, they have more information available for post-incident analysis.

Good traceability means the team can learn from errors found in the decision history and improve the verification process.

For example, a face comparison may succeed while the session contains strong evidence of camera substitution. In that case, the face-matching technology may have done exactly what it was asked to do; the problem can lie in the decision logic, which allowed a positive comparison to outweigh an untrusted capture source.

Once the cause is understood, it is important for the finding to make its way back into the verification process. The team can propose a rule change, test it against similar fraud attempts and legitimate customers, and only then apply it to future checks.

The cycle can look like this:

Identified failure → Proposed rule change → Testing → New rule rollout → Next verification

The testing step deserves some attention. A stricter rule may stop the fraud pattern it was designed for and still send too many legitimate customers into retries or manual review. So the investigation becomes more useful when the organization understands both sides of the change.

The same logic applies to human review. If reviewers repeatedly clear document-holder mismatches because the document itself authenticated correctly, the case history points toward the review policy rather than the document check.

That is where reconstruction starts earning its value: the organization can see what failed, change the relevant part, and test whether the next decision is better.

Requests to explain identity-related decisions to external parties are common among crypto respondents. 87% of respondents say their organization has had to explain an identity-related decision to a regulator, court, or external auditor. That is six percentage points higher than the pooled result for the other sectors.

At the same time, though, among respondents who had already faced an external request, reported audit-grade evidence is almost identical: 70 vs. 68.

Now, those figures are not proof that Crypto companies are losing information somewhere between investigation and audit. The questions use different respondent bases, and respondents assessed their own capabilities.

They do, however, describe two different jobs.

An internal investigator can often open several systems, recognize an internal result code, find a linked attachment, or ask the analyst who handled the case what happened. A regulator, court, or external auditor does not automatically have that context. The organization has to provide enough of it for somebody outside the original decision to follow the reasoning.

For example, “approved after manual review” tells an external reviewer very little. A record should be able to show what evidence was available, what the automated checks reported, which rule applied, whether somebody overrode the result, why they did so, and when each step happened.

It is important for the case record to preserve three things:

• Evidence: The submitted material and verification findings available when the decision was made

• Reasoning: The applicable rules and any reviewer intervention, including the reason for an exception

• History: The final decision and later changes, with timestamps that preserve their order

Later reassessment also needs its own place in that history. If old evidence is processed again with a newer model or different rule set, the new finding can be useful, but it should remain clear that the organization did not have that information when it made the original decision.

Taken together, the findings do not point to one missing check. They show why an identity decision can depend on several kinds of evidence at once: 

• whether the document is genuine, 

• whether the person is its rightful holder, 

• whether the biometric media came from a trustworthy live capture, 

• how the system resolved those findings,

• what remains available when somebody later asks why the decision was made.

Crypto already leads the surveyed industries in full decision reconstruction. The next opportunity is to use that visibility as a feedback loop. When an investigation reveals a recurring failure, teams can adjust the relevant workflow, test the change against both fraud attempts and legitimate customers, and apply it to comparable future cases.

There is a clear business reason for doing so: 48% of Crypto respondents associate incorrect identity verification results with financial loss, compared with 38% in the other sectors. 

Regula IDV Platform supports this approach by connecting onboarding, re-verification, customer history, case review, decision logic, and audit evidence across the identity lifecycle. This allows organizations to strengthen verification when risk or uncertainty increases while preserving the context needed to explain each decision later.

For Crypto, mature KYC means connecting identity evidence into a coherent decision, learning from failures, and preserving the context needed to explain why that decision was made.

The full Regula survey report contains the wider industry findings.

To discuss document authentication, biometric verification, or identity lifecycle management, talk to Regula’s experts.