In March 2025, a finance director at a multinational firm in Singapore authorised a US$499,000 payment during what appeared to be a Zoom call with the company’s senior leadership. There was just one problem: none of the people on the call were real.

What seemed like a routine virtual meeting turned out to be a highly orchestrated deepfake scam, where cybercriminals used artificial intelligence to impersonate the company’s Chief Financial Officer and other top executives. The finance director, believing the request was genuine, wired nearly half a million dollars to a fraudulent account.

The incident has sent shockwaves across the financial and corporate world, underscoring the fast-evolving threat of deepfake technology.

Background of the Scam

According to Singapore police reports, the finance executive received a message from someone posing as the company’s UK-based CFO. The message requested an urgent fund transfer to facilitate a confidential acquisition. To build credibility, the fraudster set up a Zoom call — featuring multiple senior executives, all appearing and sounding authentic.

But the entire video call was fabricated using deepfake technology.

These weren’t just stolen profile photos; they were AI-generated likenesses with synced facial movements and realistic voices, mimicking actual executives. The finance director, seeing what seemed like familiar faces and hearing familiar voices, followed through with the transfer.

Only later did the company realise that the actual executives had never been on the call.

What the Case Revealed

This wasn’t just another phishing email or spoofed WhatsApp message. This was next-level digital deception. Here’s what made it chillingly effective:

• Multi-party deepfake execution – The fraud involved several synthetic identities, all rendered convincingly in real-time to simulate a legitimate boardroom environment.
• High-level impersonation – Senior figures like the CFO were cloned with accurate visual and vocal characteristics, heightening the illusion of authority and urgency.
• Deeply contextual manipulation – The scam leveraged business context (e.g. M&A activity, board-level communications) that suggested insider knowledge.

Singapore’s police reported this as one of the most convincing cases of AI-powered impersonation seen to date — and issued a national warning to corporations and finance professionals.

Impact on Financial Institutions and Corporates

While the fraud targeted one company, its implications ripple across the entire financial system:

Deepfake Fatigue and Trust Erosion

When even video calls are no longer trustworthy, confidence in digital communication takes a hit. This undermines both internal decision-making and external client relationships.

CFOs and Finance Teams in the Crosshairs

Finance and treasury teams are prime targets for scams like this. These professionals are expected to act fast, handle large sums, and follow instructions from the top — making them vulnerable to high-pressure frauds.

Breakdown of Traditional Verification

Emails, video calls, and even voice confirmations can be falsified. Without secondary verification protocols, companies remain dangerously exposed.

Lessons Learned from the Scam

The Singapore deepfake case isn’t an outlier — it’s a glimpse into the future of financial crime. Key takeaways:

1. Always Verify High-Value Requests
   Especially those involving new accounts or cross-border transfers. A secondary channel of verification — via phone or an encrypted app — is now a must.
2. Educate Senior Leadership
   Executives need to be aware that their digital identities can be hijacked. Regular briefings on impersonation risks are essential.
3. Adopt Real-Time Behavioural Monitoring
   Advanced analytics can flag abnormal transaction patterns — even when the request appears “approved” by an authority figure.
4. Invest in Deepfake Detection Tools
   There are now software solutions that scan video content for artefacts, inconsistencies, or signs of AI manipulation.
5. Strengthen Internal Protocols
   Critical payment workflows should always require multi-party authorisation, escalation logic, and documented rationale.

The Role of Technology in Prevention

Scams like this are designed to outsmart conventional defences. A new kind of defence is required — one that adapts in real-time and learns from emerging threats.

This is where Tookitaki’s compliance platform, FinCense, plays a vital role.

Powered by the AFC Ecosystem and Agentic AI:

• Typology-Driven Detection: FinCense continuously updates its detection logic based on real-world scam scenarios contributed by financial crime experts worldwide.
• AI-Powered Simulation: Institutions can simulate deepfake-driven fraud scenarios to test and refine their internal controls.
• Federated Learning: Risk signals and red flags from across institutions are shared securely without compromising sensitive data.
• Smart Case Disposition: Agentic AI reviews and narrates alerts, allowing compliance officers to respond faster and with greater clarity — even in complex scams like this.

Moving Forward: Facing the Synthetic Threat Landscape

Deepfake technology has moved from the realm of novelty to real-world risk. The Singapore incident is a wake-up call for companies across ASEAN and beyond.

When identity can be faked in real-time, and fraudsters learn faster than regulators, the only defence is to stay ahead — with intelligence, collaboration, and next-generation tech.

Because next time, the CEO might not be real, but the money lost will be.

The financial services industry stands at a crossroads. Despite investing over $180 billion annually in financial crime compliance globally, financial institutions are failing spectacularly at their primary mission: preventing financial crime. Money launderers successfully process between $2-5 trillion annually representing up to 5% of global GDP, while authorities intercept less than 1-2% of these illicit flows. Meanwhile, traditional compliance systems generate false positive rates exceeding 90%, overwhelming investigators with irrelevant alerts while real threats slip through undetected.

This paradox reveals a fundamental crisis in how the industry approaches AI governance. Rather than enabling better crime detection, current compliance-heavy frameworks are creating bureaucratic bottlenecks that simultaneously stifle innovation and undermine security. The result is a vicious cycle where institutions spend more on compliance while becoming less effective at preventing actual crimes.

The Compliance Industrial Complex in APAC

Financial institutions across Asia-Pacific have built what amounts to a compliance industrial complex; one that checks every regulatory box, but often misses the mark on actual financial crime deterrence.

Spending is rising sharply. AML compliance costs in APAC have grown by 9–10% over the past two years, particularly in markets like Singapore, Malaysia, Indonesia, and the Philippines. Midsize to large firms in the region now spend between US $12–14 million annually, while smaller institutions are still allocating US $1–2 million each year, a substantial burden relative to their size.

Yet these escalating costs haven’t translated into better outcomes. Detection rates remain low. Analyst burnout is on the rise, but hiring lags behind, especially as firms struggle to find compliance professionals with both regulatory expertise and technical fluency. The result? A growing volume of alerts, an overstretched workforce, and mounting operational risk.

This misalignment between cost and capability has created a vicious loop: more money, more tools, more alerts - but no meaningful reduction in actual financial crime.

The Alert Avalanche in APAC

Nowhere is the dysfunction more evident than in APAC’s transaction monitoring systems. Alert volumes have surged by 800% in recent years, yet over 90% of these alerts are false positives, according to the AML Tech Barometer. This means investigators spend the bulk of their time chasing noise instead of identifying true threats.

The consequences are more than operational, they’re systemic. According to the Nasdaq Global Financial Crime Report 2024, APAC recorded the highest global fraud losses, totalling US $221.4 billion, with US $190 billion attributed to payments fraud alone.

These figures reflect a deeper issue: compliance teams are drowning in alerts that fail to distinguish genuine threats from benign anomalies. While real criminal behaviour evolves, traditional detection systems lag — overwhelmed by volume, underpowered in intelligence, and increasingly ineffective at stopping sophisticated financial crime.

Innovation Paralysis Through Regulatory Complexity

The compliance-first approach has created a regulatory environment that actively discourages innovation. Traditional vendors promote complex 12-point compliance frameworks that promise "audit readiness" through extensive documentation and multi-layered governance structures. While these frameworks appear comprehensive, they suffer from critical weaknesses that paradoxically increase both compliance risk and innovation costs.

Bureaucratic Bottlenecks

Heavy regulatory frameworks create bureaucratic bottlenecks that slow innovation. Financial institutions now spend 40% of their compliance budget on documentation and audit preparation rather than actual crime detection capabilities. This misallocation of resources means that institutions are investing heavily in appearing compliant rather than being effective.

The regulatory landscape has become a maze of conflicting requirements. Over 40 countries have initiated or enacted national AI policies, with more than a dozen introducing sector-specific financial services guidance. However, instead of harmonisation, regulatory divergence is accelerating, creating what experts call "regulatory fragmentation" that leaves multinational banks caught in crossfire between inconsistent standards.

{{cta-first}}

The Innovation-Compliance False Dichotomy

Current approaches perpetuate a false dichotomy between innovation and compliance, suggesting these goals are fundamentally incompatible. This thinking has led to what researchers call the "innovative trilemma"e perceived impossibility of simultaneously maintaining market integrity, providing clear guidance, and fostering innovation.

The European Union's AI Act exemplifies this challenge. While intended to create harmonized standards, financial services firms report that the heavy burden of documentation, mandatory transparency, and strict compliance checks can slow innovation considerably. Banks and insurers have requested reductions in real-time monitoring requirements, arguing that these can be "disproportionate and discourage innovation."

Real-World Consequences in APAC

Security Failures at Scale

• APAC lost US $221.4 billion to fraud in 2024, the highest globally even as AML compliance spending soared. ‍
• Traditional, reactive detection systems continue to let sophisticated scams slip through.

Operational Inefficiencies

• Siloed systems and poor data quality create compliance gaps.
• Analysts spend excessive time on false positives, detracting from detecting real threats.

A Growing Talent Crisis

• Many APAC compliance teams are understaffed, despite high workloads and pressure to adopt advanced tech.
• Talent now needs both regulatory know-how and technological fluency, a rare costly combination.

The Path Forward: From Compliance to Governance

The evidence is overwhelming: compliance-first AI approaches are failing on their own terms while simultaneously stifling the innovation needed to address evolving threats. Financial institutions cannot continue down this path of escalating complexity and decreasing effectiveness.

The solution lies not in abandoning compliance but in reframing the entire approach around governance rather than checkbox mentality. Governance-first AI focuses on building systems that are inherently trustworthy, transparent, and effective - qualities that naturally satisfy regulatory requirements while enabling innovation.

This represents a fundamental shift from reactive compliance to proactive governance, from fragmented systems to integrated platforms, and from bureaucratic overhead to operational effectiveness. The institutions that embrace this transition will not only achieve superior compliance outcomes but will also gain competitive advantages through more effective crime detection and lower operational costs.

Conclusion

The AI governance crisis in financial services is not a technical problem, it is a strategic challenge that requires fundamental rethinking of how institutions balance innovation with risk management. The current compliance-first paradigm has demonstrated its limitations through massive costs, operational inefficiencies, and security failures.

The time has come to move beyond the false dichotomy of innovation versus compliance toward a governance-first approach that treats trustworthy AI as a competitive advantage rather than a regulatory burden. The institutions that make this transition first will not only achieve better compliance outcomes but will also position themselves to lead the next generation of financial crime prevention.

What’s Next in This Blog Series

In our next blog, we'll explore how initiatives like Singapore's AI-Verify program are pioneering the governance-first approach and setting new standards for responsible AI deployment in financial services.

Stay tuned.

AUSTRAC’s latest draft rules signal a defining moment for AML compliance in Australia.

With growing pressure to address regulatory gaps and align with global standards, AUSTRAC has released a second exposure draft of AML/CTF rules that could reshape how financial institutions approach compliance. These proposed updates are more than routine tweaks, they are part of a strategic pivot aimed at strengthening Australia’s financial crime defences following international scrutiny and domestic lapses.

Background: Why AUSTRAC Is Updating the Rules

AUSTRAC’s policy overhaul comes at a critical time for the Australian financial sector. After years of industry feedback, regulatory incidents, and repeated warnings from the Financial Action Task Force (FATF), Australia has faced growing pressure to modernise its AML/CTF framework. This pressure intensified after the Royal Commission findings and the high-profile Crown Resorts case, which exposed systemic failures in detecting and reporting suspicious transactions.

The second exposure draft released in July 2025 reflects AUSTRAC’s intent to close key compliance loopholes and bring the current system in line with global best practices. It expands on the earlier draft by incorporating industry consultation and focuses on more granular obligations for customer due diligence, ongoing monitoring, and sanctions screening. These changes aim to strengthen Australia’s position in the face of a rapidly evolving threat landscape driven by digital finance, cross-border transactions, and sophisticated laundering techniques.

What’s Changing: Key Highlights from the Exposure Draft Rules

The second exposure draft introduces several new requirements that directly impact how reporting entities manage risk and monitor customers:

1. Clarified PEP Obligations

The draft now defines a broader set of politically exposed persons (PEPs), including foreign and domestic roles, and mandates enhanced due diligence regardless of source of funds.

2. Expanded Ongoing Monitoring

Entities must now monitor customers continuously, not just at onboarding, using both transaction and behavioural data. This shift pushes compliance teams to move from static checks to dynamic, risk-based reviews.

3. Third-Party Reliance Rules

The draft clarifies when and how financial institutions can rely on third parties for KYC processes. This includes more specific provisions for responsibility and liability in case of failure.

4. Sanctions Screening Expectations

AUSTRAC has proposed more stringent guidelines for sanctions screening, especially around name-matching and periodic list updates. There is also an increased focus on ultimate beneficial ownership.

5. Obligations for Fintechs and Digital Wallet Providers

The draft recognises the role of digital services and imposes tighter onboarding and monitoring standards for high-risk products and cross-border offerings.

Comparing ED2 with Tranche 2 Reforms

While Tranche 2 reforms remain on the horizon with a broader mandate to include lawyers, accountants, and real estate agents under the AML/CTF regime, the second exposure draft zeroes in on tightening the compliance expectations for existing reporting entities.

Unlike Tranche 2, which aims to expand the scope of regulated professions, the exposure draft rules focus on strengthening operational practices such as ongoing monitoring, customer segmentation, and enhanced due diligence for existing covered sectors. The rules also go deeper into technological expectations, such as maintaining audit trails and validating third-party service providers.

In short, ED2 is more about modernising the how of AML compliance, whereas Tranche 2 will eventually reshape the who of the regulated ecosystem.

Why It Matters for Financial Institutions

For compliance officers and risk managers, these proposed changes translate to increased scrutiny, more granular documentation, and an urgent need to improve monitoring practices. Institutions will be expected to maintain stronger evidence trails, adopt real-time monitoring tools, and improve their ability to detect behavioural anomalies across customer life cycles.

Moreover, the clear emphasis on risk-based ongoing due diligence means firms can no longer rely on periodic checks alone. Dynamic updates to risk profiles, responsive escalation triggers, and cross-channel data analysis will become critical components of future-ready compliance programs.
‍
{{cta-first}}

Tookitaki’s Perspective and Solution Fit

At Tookitaki, we believe AUSTRAC’s second exposure draft offers an opportunity for Australian institutions to build more resilient, intelligence-driven compliance programs.

Our flagship platform, FinCense, is built to adapt to evolving AML obligations through its scenario-driven detection engine, AI-led transaction monitoring, and federated learning capabilities. Financial institutions can seamlessly adopt continuous risk monitoring, generate audit-ready investigation trails, and integrate sanctions screening workflows, all while maintaining high levels of precision.

Importantly, Tookitaki’s federated intelligence model draws from a community of AML experts to anticipate emerging threats and codify new typologies. This ensures institutions stay ahead of bad actors who are constantly evolving their methods.

What’s Next: Preparing for the New Rules

AUSTRAC is expected to finalise the rules following this round of industry consultation, with phased implementation timelines to be announced. Financial institutions should begin by assessing gaps in their existing AML controls, especially around ongoing monitoring, PEP screening, and documentation processes.

This is also a good time to evaluate technology infrastructure. Solutions that enable scalable monitoring, natural language audit logs, and flexible rule design will give institutions a distinct advantage in meeting the new compliance bar.

Conclusion

AUSTRAC’s second exposure draft marks a pivotal shift from checkbox compliance to intelligent, risk-driven AML practices. For financial institutions, the future of compliance lies in adopting flexible, technology-powered solutions that can evolve with the regulatory landscape.

The message is clear, compliance is no longer a static requirement. It is a dynamic, strategic pillar that demands agility, insight, and collaboration.