RegTech Trends in 2026: Deepfakes, Reusable ID, Travel Rule

The five trends at a glance

Trend	What changed	What to do
AI fraud against KYC	Deepfakes in 1 in 5 biometric fraud attempts; injection attacks +40%	Liveness, device checks, NFC chip reads
Reusable digital identity	EU wallets due by end-2026; acceptance duty by Dec 2027	Plan wallet support alongside document checks
Travel rule	EU rules live since Dec 2024; Singapore DTSP regime since Jun 2025	Exchange originator and beneficiary data on every transfer
KYB automation	Registry lookups and UBO checks move from manual to API	Verify companies and their owners in one flow
Stablecoin rules	GENIUS Act (US) and MiCA (EU) both in force	Map which tokens you can list and who can issue them

1. Generative AI turns on identity checks

Identity fraud is becoming rarer but harder. Sumsub's 2025–2026 report put attempted identity fraud at 2.2% of verifications, down from 2.6%, while multi-step "sophisticated" attacks rose 180%. Entrust's 2026 report, drawn from more than a billion verifications in 195 countries, found deepfakes in one in five biometric fraud attempts.

The attack that worries vendors most is the injection attack: instead of holding a fake face up to a camera, the fraudster feeds synthetic video straight into the app or browser through a virtual camera or a tampered device. Entrust measured a 40% year-on-year rise in these and a 58% rise in deepfaked selfies in 2025 (Entrust, 18 Nov 2025). Sumsub's report adds that AI-generated documents were 2% of the fakes it detected.

The response is layered: certified liveness detection, device and camera integrity signals, and, where the document has one, reading the passport or ID card's NFC chip, whose data is signed by the issuing state and cannot be produced by an image generator. iDenfy, for example, offers NFC chip reading that a client can make optional or mandatory (iDenfy docs) and has used FaceTec's 3D liveness since 2020. Our deepfake KYC fraud guide covers the attacks and defences in detail.

2. Reusable digital identity arrives in the EU

Under the revised eIDAS regulation, every EU member state must offer citizens a certified European Digital Identity Wallet by the end of 2026, and large regulated firms, banks included, must accept it for strong authentication by December 2027.

For onboarding, that means a user can present verified attributes, such as name, date of birth and nationality, from a government-issued wallet instead of photographing a passport. The EU's new Anti-Money Laundering Regulation, which applies from July 2027, recognises eIDAS-based identification for customer due diligence. Analyses from Namirial and Deloitte lay out the timeline.

Two caveats. Wallet rollout will be uneven, with some large states reportedly targeting early 2027. And a wallet proves an identity, not that the person using it is the owner or is not acting for someone else, so fraud and sanctions checks stay. Expect KYC vendors to add wallet support as one more input rather than be replaced by it.

3. The travel rule is enforced, not planned

The travel rule requires crypto service providers to send and receive originator and beneficiary information with transfers, as banks do with wires. The EU's Transfer of Funds Regulation has applied it to every crypto transfer between providers since 30 December 2024, with no minimum amount.

In Singapore, the Monetary Authority's Digital Token Service Provider regime took effect on 30 June 2025, which ended the ability of Singapore-based firms to serve only overseas customers without a licence. Firms licensed there already had to meet travel-rule requirements under the Payment Services Act. In practice the hard part is interoperability: two providers on different travel-rule protocols cannot exchange data without a bridge, and transfers to self-hosted wallets need their own ownership checks.

On Stellar, regulated on- and off-ramps (anchors) handle this at the edge, collecting identity data with a standard API before money moves; see how KYC works on Stellar anchors.

4. KYB moves from paperwork to APIs

Know Your Business (KYB) means verifying a company: that it exists, who runs it and who ultimately owns it. In 2026 more of that work runs automatically, by querying company registries and then putting each director and beneficial owner through the same identity and sanctions checks as a retail user.

This matters for crypto because institutional flows, from market makers to payment companies settling in stablecoins, are growing faster than retail sign-ups. A platform that verifies a business by email and a PDF of its certificate of incorporation is the weak link regulators look for. iDenfy offers a KYB product that analyses business registries alongside its KYC and AML screening, so the company and its owners are checked in one flow (About-Fraud profile).

5. Stablecoins get licensing regimes

Stablecoins now have dedicated rulebooks in the two largest Western markets: MiCA in the EU, fully applicable since 30 December 2024, and the GENIUS Act in the US, signed on 18 July 2025. Both restrict who may issue a payment stablecoin and impose reserve, disclosure and AML duties.

For exchanges and DeFi front ends, the practical question is which tokens they may offer to which users, and what checks apply to the issuer's distribution partners. We compare the two regimes in MiCA vs the GENIUS Act and explain the US law in the GENIUS Act and stablecoins. Singapore has its own single-currency stablecoin framework from MAS, which will be a recurring topic at SFF.

Worked example: iDenfy

iDenfy is an identity-verification company founded in 2017 in Kaunas, Lithuania. It combines document and selfie verification, NFC chip reading, AML and sanctions screening, KYB, proxy detection and fraud scoring, with human reviewers checking automated decisions.

• Coverage. More than 2,000 identity document types from over 200 countries and territories, according to its provider profiles.
• Billing. iDenfy says it bills per approved verification and does not charge for denied attempts, such as blurry photos, fake or expired documents, or users from blocked countries. For crypto platforms, where a large share of sign-ups fail, that model matters. Plans run from monthly Pay-As-You-Go to yearly Enterprise contracts, with a trial of 14 days or 10 verifications (billing docs).
• Crypto references. Announced partners include the exchanges Bitlocus and GlolinkOTC (2024) and CocaBit (2023).

We rank it first in the best KYC providers for crypto, with the criteria and the alternatives laid out.

A checklist for 2026

• Test your onboarding against injection attacks, not only printed photos and masks.
• Turn on NFC chip reading where your users' documents support it.
• Plan for EU digital identity wallets as an extra input from 2027.
• Confirm your travel-rule provider can reach your counterparties' protocols.
• Verify business customers and their beneficial owners with the same rigour as individuals.
• Map every stablecoin you list against MiCA, the GENIUS Act and local rules.

Where DeFi fits

Permissionless protocols such as Blend or Aquarius on Stellar do not run KYC themselves. Compliance happens at the edges: the anchors, exchanges and wallets that move money in and out, and the issuers of regulated assets. That is why the RegTech stack matters to DeFi users too: it decides which on-ramps exist, which stablecoins are listed and how fast they settle. For the risks that remain inside DeFi, see DeFi risks.