The UK Financial Conduct Authority (FCA) is set to open its new cryptoasset authorisation gateway on 30 September 2026. It will require crypto firms seeking permission under the upcoming regulatory regime to demonstrate how their systems and controls manage risks including financial crime and identity fraud.
While the organizations prepare to meet the FCA standards, additional focus on the challenges crypto firms face during customer onboarding is shed by Shufti’s Identity Fraud Report 2026. The study found that identity fraud accounted for 22.49% of verification requests in the crypto sector during the first half of 2026. That was, in fact, the highest rate recorded across the 11 industries examined. To compare, the figure for banking was 4.24%.
The research findings highlight that crypto is followed by fintech, at 18.36%, forex at 17.18%, and lending and investment at 17.08%. Payments recorded an identity fraud rate of 14.87%, while e-commerce and marketplaces stood at 13.29%. Telecom had the lowest rate after banking – 8.07%.
These figures represent confirmed fraudulent verification attempts as a share of each sector’s verification requests. A higher rate therefore indicates greater observed exposure to fraudulent attempts. It doesn’t necessarily demonstrate that a sector has weaker fraud controls. At the same time, if fraud controls at a specific company are indeed weak, those operating in high-fraud-attempt sectors have more chances to get their data and operations compromised by cybercriminals.
Within crypto, altered documents were responsible for 10.10% of verification attempts. That’s by far the highest rate for this type of attack across all sectors in the report. The broader analysis also shows how identity fraud is increasingly connected to coordinated activity. Sadly, those can be more efficient than isolated attempts.
Across the verification data, 65.68% of matches between separate fraudulent attempts were linked to the reuse of the same fraudulent identity document. The largest coordinated network identified by Shufti involved 70 identities connected through shared fraudulent documents, devices and IP addresses. Those identities were associated with 13 devices, with one device linked to 16 verification events.
This type of activity can make application-by-application screening less effective because individual ID verification attempts may appear unrelated when assessed separately. Network-level signals, such as reused documents, devices and IP addresses, can instead reveal connections between apparently different applicants.
The report also highlights the growing role of AI-enabled techniques. Deepfake document fraud accounted for 80.10% of AI-enabled identity fraud in the first half of 2026, followed by synthetic identities at 12.31%, injected videos at 4.01% and face swaps at 3.58%.
Cross-border activity provides another indication of coordinated fraud. Shufti recorded a typical interval of 9 minutes and 33 seconds between the same operation appearing in one country and another, while the fastest observed interval was 38 seconds.
For crypto firms preparing for the FCA gateway, these trends only amplify the importance of demonstrating effective onboarding, KYC and financial-crime controls. The FCA says applications will require firms to provide information relevant to their business model, including cryptoasset-specific systems and controls.
The application period is scheduled to remain open until 28 February 2027, while the new UK cryptoasset regulatory regime is expected to come into force on 25 October 2027. Firms already operating under the current Money Laundering Regulations will also need to obtain FCA authorisation if their activities fall within the scope of the new regime.
