Compliance at the crossroads: Regulators are tougher, criminals are smarter

As global enforcement ramps up, AI is handing fraudsters new weapons. Here’s why law firms and reporting entities must evolve faster than the threat.

There is a quiet but fierce arms race happening in compliance teams across the UK, Australia and New Zealand. On one side are regulators, emboldened, resourced and increasingly vocal about failures. On the other hand are criminals, smarter, faster and armed with generative AI.

In the middle sit law firms, real estate agencies and accounting practices trying to keep pace with both.

The era of checkbox compliance is over. Superficial processes and outdated tools are now liabilities. As enforcement and fraud both accelerate, the firms that remain most compliant will be those that evolve quickly.

The global enforcement wave has landed

Around the world, regulators are making it clear: excuses will no longer cut it.

In the UK, the Solicitors Regulation Authority (SRA) is cracking down hard on AML breaches. Fines for firms have surged past six figures, not just for major criminal breaches but for sloppy systems, inadequate oversight and missing documentation. These are no longer gentle nudges. They are headline-making penalties that hit where it hurts: reputation, revenue and regulatory standing.

In Australia, AUSTRAC’s second tranche of AML reforms is well underway. Law firms, accountants and real estate agents will soon fall under mandatory AML/CTF obligations. And if Tranche 1 is anything to go by, AUSTRAC will not be shy in enforcing them. Just ask the major banks and casinos that have paid billions in fines over the past five years.

New Zealand’s Financial Markets Authority (FMA) and Department of Internal Affairs (DIA) are also on the front foot. They have made it clear that CDD lapses, poor record-keeping and failure to escalate red flags will result in penalties, especially from firms that should know better.

Regulators across these markets are aligned on one thing: enforcement is about effectiveness, not effort. You do not get credit for trying. You need to show real, auditable systems that work.

Criminals now have AI, and they are using it

At the same time, criminal tactics are evolving at a terrifying speed. And AI is making it worse.

In a now-viral LinkedIn post, a compliance professional tested ChatGPT and a handful of AI image generators to create a fake passport. It took less than five minutes. The results? Convincing enough to fool even experienced onboarding teams.

Stories like this are not just internet curiosities. They are flashing red warnings about the limitations of traditional document verification. Scanned PDFs. Emailed copies. Trusting a document simply because it looks official. Those methods were already risky. Now they are indefensible.

Even seasoned compliance officers are second-guessing their own processes and their own IDs. One of our team members at First AML shared this from a recent customer conversation after explaining the risk of AI by showing this fake passport:

 “I don’t even trust my own passport anymore.”

They are right to be concerned. If you cannot trust what you see, you need systems that go deeper.

The compliance arms race is real, and you cannot just keep up

Matching the pace of fraud is no longer enough. You need to outrun it.

The firms that thrive in this environment are not just buying tools. They are investing in transformation. That means building AML infrastructure that goes beyond checkbox compliance to deliver defensible, automated and intelligent processes.

Modern AML requires:

• Biometric verification to confirm that a person is who they say they are, not just that they have a passport
• Liveness detection to prevent deepfakes, spoofing and synthetic IDs from slipping through
• Tamper-proof document technology that validates the integrity of the source, not just the image
• Automated, auditable workflows that track every step, flag issues early, and reduce human error

This is the new minimum standard. And it is where firms need to move quickly.

Do not get caught playing the old game

AI is not coming. It is already here. And it is already in the hands of bad actors who do not play by the rules.

Meanwhile, the regulators are watching and ready to act when firms fall short.

In this environment, ticking boxes is not enough. You need compliance systems that are fast, smart and impossible to fake your way through.

And if you are relying on traditional tools like email, spreadsheets or PDFs, ask yourself: are you keeping up, or are you falling behind?

Closing the gap

The enforcement and fraud gap is widening. Law firms, real estate agencies and accounting practices that close it will do so by investing in technology that:

• Verifies people and documents with modern methods
• Keeps a clear, auditable trail of every action
• Helps staff stay compliant without needing to be compliance experts
• Evolves continuously as threats change
• Works seamlessly with international clients, verifying global identities and documents across jurisdictions.

That is where we have invested. That is what we help firms do. And that is why now is the time to reset your AML approach, before the criminals or the regulators force your hand.