Ultimate beneficial ownership (UBO) registers rest on a simple promise: that behind every company, a real person can be found. Generative AI is quietly breaking that promise, as synthetic identities make it possible for the “person” at the end of the ownership chain to never have existed at all.
According to RelyComply, while governments have been slow to adopt centralised frameworks for identifying a business’s key beneficiaries, criminals have moved faster. Long-standing threats such as shell companies and nominee directors are now blended with AI-generated identities and documents, meaning UBO investigation must evolve before it has fully matured.
Fabricated persons can be recycled across the financial system, undermining global anti-money laundering (AML) efforts and allowing fraud to scale.
In South Africa, a beneficial owner is defined as a natural person who ultimately owns or effectively controls a company, with the Companies and Intellectual Property Commission (CIPC) applying a disclosure threshold of 5% or more of shares or voting rights.
Under the Financial Intelligence Centre Act (FICA), accountable institutions must identify and verify their clients’ beneficial owners, while companies separately report ownership data to CIPC’s national register, launched in 2023. Distinguishing a genuine owner from a convenient stand-in, however, often falls to each institution’s judgement.
The scale of the problem is growing. Thomson Reuters reported in 2023 that synthetic identity fraud accounts for more than 80% of new account fraud. In South Africa, traditional document fraud dropped 73% in the first quarter of 2025, while synthetic identity fraud jumped 153% year on year.
Cheap, accessible deepfake tools can now swap faces, mimic movement and generate synthetic voices convincing enough to defeat biometric checks. More sophisticated “injection” attacks intercept APIs to feed manipulated media directly into identity verification (IDV) systems. Meanwhile, generative AI can produce trust deeds, partnership agreements and organograms on demand, bolstering fake identities with plausible paperwork.
Traditional IDV, registry checks and PEP and sanctions screening may spot a forged document, but they still assume a real human stands behind it. A synthetic UBO that slips past one institution can be reused across multiple companies and jurisdictions, and firms without shared visibility will miss the pattern.
The answer, according to the article, lies in RegTech. UBO declarations should be backed by biometric IDV as standard, including liveness checks that analyse micro-movements, lighting anomalies and skin texture.
Crucially, verification cannot be a one-off exercise. Just as perpetual KYC is becoming the norm, UBO checks should shift to continuous monitoring, using dynamic risk scoring to flag behavioural anomalies, react to structural changes and maintain a clear audit trail for supervisors.
Greater cross-border intelligence sharing between institutions, the FIC and FATF would further strengthen defences. The problem becomes solvable once the industry treats synthetic identity as a baseline assumption rather than an edge case.
Read the full RelyComply post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
