Synthetic identity fraud detection: which CIP controls do broker-dealers need?

If your firm opens accounts online, some of your newest customers may not exist. FINRA's 2026 oversight report faults broker-dealers that auto-approved accounts without reasonably verifying identity, which puts synthetic identity fraud detection squarely on the CCO's and AML officer's list: an examiner will ask how your onboarding stack would spot a customer who was never real.

What is synthetic identity fraud, and why does it get past account opening?

A synthetic identity pairs a real Social Security number with a false name, address and date of birth. That is FINRA's own description in Regulatory Notice 20-13, which reported firms seeing more fraudulent new accounts opened with stolen or synthetic identities, funded from victims' bank accounts and emptied quickly. Each piece of the application can look valid on its own, so a check that only confirms a number exists can approve a customer who does not exist.

FINRA noted in Regulatory Notice 20-32 that these schemes can go undetected longer because there is no clearly identifiable victim to complain. Account takeover gets reported when a real customer notices. A synthetic account has no real customer, so the firm's own controls are often the only thing that can catch it.

What does the CIP rule require a broker-dealer to do?

The Customer Identification Program rule, 31 CFR 1023.220, requires a written, risk-based program that lets the firm form a reasonable belief that it knows each customer's true identity. The CIP must sit inside the firm's anti-money laundering program, which FINRA Rule 3310 requires every member to maintain. The core requirements are:

• Collect at least name, date of birth, address and an identification number before opening the account.
• Verify identity within a reasonable time before or after opening, and describe when the firm uses documents, non-documentary methods, or both.
• Have non-documentary procedures for accounts opened without the customer appearing in person, for unfamiliar documents, and for other higher-risk situations.
• Have procedures for when the firm cannot form a reasonable belief: when not to open, what the customer may do while verification is pending, when to close, and when to file a Suspicious Activity Report.
• Keep identifying information for five years after the account closes, and verification records (documents relied on, non-documentary methods and results, and how each substantive discrepancy was resolved) for five years after the record is made.

For an online-only firm, nearly every account is a non-face-to-face account, so the non-documentary procedures carry most of the weight. Regulation S-ID adds a second layer: a written identity theft prevention program that identifies and responds to red flags at account opening and afterward.

Where are examiners finding CIP and identity verification gaps?

FINRA's 2026 Annual Regulatory Oversight Report finds CIP gaps where firms auto-approve new accounts without reasonably verifying the customer's identity. Its examples include an applicant whose Social Security number was not valid or was associated with the name of a different person. Other firms had not established policies and procedures reasonably expected to detect identity theft. The report also names common identifying information across seemingly unrelated accounts as a sign of identity theft or synthetic identity fraud at account opening.

The pattern across these findings is automation without tuning: an approval workflow that moves fast and never asks whether the same phone number, email or bank account has appeared under three different names.

How is generative AI changing new account fraud?

Generative AI makes fake ID documents and deepfake selfies cheap to produce. The same 2026 report describes fraudsters using GenAI to create convincing fake ID documents, and taking images from customers' social media to build deepfakes that get past the photo and video checks some firms added to verification. FinCEN warned about the same tactic in Alert FIN-2024-Alert004, which describes deepfake media used to get around identity verification at financial institutions.

Knowledge-based questions are weak too, because much of the answer data is already exposed in breaches. NIST's digital identity guidelines, SP 800-63A-4, say knowledge-based verification shall not be used for identity verification. That guidance is written for federal systems and does not bind broker-dealers. It is still a useful benchmark when a vendor proposes quiz questions as a primary control.

The same tools are being used against wire desks. Our article on deepfake voices and wire transfer verification covers the callback side of this problem.

How can broker-dealers detect synthetic identity fraud at account opening?

Broker-dealers detect synthetic identity fraud by layering checks at four points (collection, verification, across applications, and funding) and keeping a record of every result. Most of these controls already exist in onboarding platforms and identity verification services. The work is turning them on, tuning them, and keeping the evidence. FINRA's 2026 report and Regulatory Notices 20-13 and 21-18 describe these practices:

At collection

• Flag temporary or fictitious email addresses.
• Compare IP address and geolocation against the stated home address.
• Detect scripted applications, such as forms completed far faster than a person could type.

At verification

• Combine documentary checks of unexpired photo ID with non-documentary checks against a consumer reporting agency or public database.
• Treat a selfie or liveness check as one signal, layered with data checks, since deepfakes are built to pass it alone.
• Reject or escalate SSNs that fail issuance validation or match death records.

Across applications

• Match phone, email, address, device and bank routing and account numbers across applications that carry different names.
• Limit automated approval of multiple accounts for one customer.

At funding and first transfers

• Confirm the name on the funding bank account matches the customer, a practice FINRA described in Regulatory Notice 20-13.
• Use a holding period on newly deposited funds and watch for rapid withdrawals, especially from accounts linked through micro-deposits.
• Require step-up authentication when a customer changes a linked bank account or email address, an adaptive authentication practice described in Regulatory Notice 21-18.

Every one of these controls should write a record. The CIP rule's recordkeeping paragraph expects the firm to show which methods it used, what the results were, and how it resolved discrepancies. A vendor dashboard with a short retention window does not meet a five-year retention requirement on its own.

Who is accountable when a verification vendor approves a fake identity?

The member firm is accountable, even when a vendor's tool made the approval decision. Regulatory Notice 21-29 reminds firms that outsourcing an activity does not relieve them of supervisory responsibility for it. The CIP rule does let a broker-dealer rely on another financial institution's CIP in limited cases, but only where that institution is regulated by a federal functional regulator, the reliance is reasonable, and the institution certifies its AML program annually. A software vendor that scores selfies and documents is a tool the firm uses, so the firm owns its configuration and results.

In practice, that means knowing the vendor's thresholds, which checks are on, what happens to a borderline score, and whether alerts route to a person who can decline the account or escalate to the AML officer. FINRA's 2026 report lists ensuring that tools used for automated customer verification are reasonably designed to detect red flags as an effective practice. Our guide to applying Regulatory Notice 21-29 to your vendors covers the due diligence side.

What should a broker-dealer do this quarter?

Start with evidence, since that is what an examiner will ask for first:

• Pull the last 90 days of auto-approved accounts and look for shared phone numbers, emails, addresses, devices and bank accounts under different names.
• Get the verification vendor's current configuration in writing, including which checks are enabled and the score thresholds for approve, review and decline.
• Confirm the written CIP describes non-documentary methods for online accounts and the lack-of-verification steps, including the SAR decision.
• Check that verification results and discrepancy notes export to storage that meets the five-year retention periods.
• Train onboarding and operations staff on AI-generated documents, voice clones and deepfake selfies.
• Map each Regulation S-ID red flag to a specific system alert or manual review step, and note any red flag with no control behind it.

This describes what the rules and FINRA's published guidance say. How a specific firm applies them depends on its business, and that call belongs to the firm's compliance and legal teams.

How can s90 help?

s90 supports broker-dealers and dual-registered firms on the technology side of these controls: tuning identity and access alerts, documenting vendor configurations, and keeping verification logs where an examiner can see them. Our agreements include a 24-hour evidence production commitment, so exam requests do not become a scramble. If you want a second look at your onboarding stack, we are happy to talk it through.