Regulatory Landscape
The world is legislating trust.
A global view of the laws now mandating scam prevention, anti-impersonation and verified identity.
Last updated: 2 October 2026
Across jurisdictions, regulators are converging on three demands — and none has legislated the method, only the outcome.
Verification & scam-prevention duties
On banks, telcos and platforms.
Anti-impersonation & synthetic-media rules
Provenance, labeling, takedown.
Government-backed digital identity
Certified, high-assurance ID.
Filter
Europe
Jurisdiction
Instrument
What it requires
Status & key dates
EU
Label AI-generated / deepfake content; providers must machine-mark synthetic media
Transparency from 2 Aug 2026; watermarking to 2 Dec 2026
EU
Platforms must counter illegal content incl. fraud/scams; VLOP systemic-risk duties
Applies since 17 Feb 2024
EU
Member States must offer a certified high-assurance ID wallet; relying parties must accept it
In force 20 May 2024; wallets by end-2026
EU
Free payee name/IBAN match check before a transfer
Euro-area PSPs from 9 Oct 2025; others 9 Jul 2027
EU
Name/IBAN checks; impersonation-fraud reimbursement; extended liability
Council texts Apr 2026; Parliament committee approved May 2026; not yet in the Official Journal
EU
AMLR (2024/1624); AMLA
Harmonized KYC/KYB due diligence; crypto CASPs to bank-grade CDD + Travel Rule
AMLA operational Jul 2025; AMLR applies 10 Jul 2027
UK
Risk-assess and mitigate illegal content incl. fraud via Ofcom codes
Illegal-harms duties from 17 Mar 2025
UK
Mandatory reimbursement of APP-scam victims up to £85k, split 50/50
In force 7 Oct 2024
UK
ECCTA 2023 — failure to prevent fraud
Large organisations liable if an associated person commits fraud for their benefit, unless reasonable prevention procedures are in place
In force 1 Sep 2025
UK
HM Treasury — Modernising payment services regulation (consultation)
Asks how consent, authentication and liability for unauthorised payments must change when AI agents initiate, approve and execute payments
Consultation 14 Jul – 6 Oct 2026
Not law — shown for direction of travel.
Not law — shown for direction of travel.
UK
Underpins a certified digital-verification-services trust framework
Provisions from 5 Feb 2026
North America
Jurisdiction
Instrument
What it requires
Status & key dates
US (federal)
Bans posing as government or business; AI-impersonation supplement pending
Effective 1 Apr 2024
US (federal)
Criminalizes non-consensual intimate deepfakes; 48-hour takedown
Signed 19 May 2025; takedown duty 19 May 2026
US (federal)
Directs FIs to detect GenAI deepfakes defeating identity checks
Issued 13 Nov 2024
US (federal)
Government-issued digital credentials (e.g. mobile driver's licences) may be used to verify identity when opening an account
Issued Sep 2026
US (federal)
Considers rules for search, social and marketplace platforms that further government and business impersonation scams
Published 1 Oct 2026; comments to 30 Nov 2026
US (federal)
Carriers must authenticate customers before SIM changes and number ports, and notify customers
Adopted Nov 2023
US (federal)
Recommends a federal task force, integrated complaint centres, cross-sector reporting and education; proposes no verification or prevention duty
Report 22 Jul 2026. Compare Australia's SPF, which imposes prevention obligations.
Not law — shown for direction of travel.
Not law — shown for direction of travel.
US (federal)
Treasury-chaired interagency task force on scams
Passed committee 49–0, Sep 2026
US (federal)
Funding and blockchain-tracing support for state and local police against elder fraud and 'pig butchering'
Passed the House 15 Sep 2026
US (federal)
Independent board with subpoena power to investigate major cyber incidents, including those carried out by AI agents
Introduced 24 Sep 2026
US (federal)
Standards project on how AI agents are identified and authorised; consumer-agent phase planned
Comment summary 29 Sep 2026; draft project next
Not law — shown for direction of travel.
Not law — shown for direction of travel.
US — California
GenAI provenance + free AI-detection tools; platform detection duty
Operative 2 Aug 2026; platform duty 1 Jan 2027
US — Texas
Bans AI use for unlawful deepfakes, manipulation, discrimination
Effective 1 Jan 2026
Canada
Verify identity incl. non-face-to-face; detect deepfakes / forged documents
Expanded scope from 1 Oct 2025
US (federal)
Independent board to investigate cyberattacks assisted by artificial intelligence
Introduced 24 Sep 2026
US (federal)
Investigation of OpenAI, Anthropic and METR following agent cyber incidents
Confirmed by the FTC, Sep 2026
Investigative phase — not law.
Investigative phase — not law.
US (California)
Inquiry into cybersecurity incidents and risks from OpenAI’s models; developers that fail to prevent attacks “can and should be held legally accountable”
Subpoena served 30 Sep 2026
Enforcement inquiry — not law.
Enforcement inquiry — not law.
US (15 states)
Demands document preservation, whistleblower protection and a halt to the tests behind the Hugging Face intrusion
Letter 3 Aug 2026
Not law — shown for direction of travel.
Not law — shown for direction of travel.
Canada
AIDA (Bill C-27)
Would have regulated high-impact AI
Lapsed Jan 2025 — no federal AI law
Asia-Pacific
Jurisdiction
Instrument
What it requires
Status & key dates
Australia
Banks, telcos, platforms must prevent, detect, disrupt, report scams; verification is the central lever
AFCA membership from 1 Sep 2026; most obligations from 31 Mar 2027; codes and rules still being developed (ACCC, Sep 2026); up to A$50M/contravention
Australia
Reviews reporting requirements, obligations of AI firms, and offences, liabilities and penalties after the Medicare statistics portal incident
Announced 24 Sep 2026
Australia
Parliamentary inquiry incl. fraud, scams and deepfakes and the adequacy of existing laws
Reports by 30 Nov 2026
Not law — shown for direction of travel.
Not law — shown for direction of travel.
Australia
Extends CDD to real estate, law, accounting, TCSPs, precious-metal dealers
Obligations from 1 Jul 2026
Australia
Mandatory registration and approval of all branded (alphanumeric) SMS sender IDs; unregistered branded IDs are labeled "Unverified" — a carrier-layer measure against impersonation SMS scams
In force 1 July 2026 (register opened 30 Nov 2025)
Australia
Accredited private-sector Digital ID providers join the government system; higher-risk services will not accept a private provider
From 1 Dec 2026
Australia
Social Media Minimum Age
Age assurance for access to social media
Rolling out 2025–26
Singapore
Shared Responsibility Framework (MAS / IMDA)
FIs and telcos must mitigate phishing scams; payouts on breach
In force 16 Dec 2024
Singapore
Restriction orders to stop victims transferring funds to scammers
Enacted 2025
Singapore
Directives to platforms to counter scam / impersonation offences
In force; directives issued
Singapore
Anti-spoofing and scam controls for WhatsApp, Telegram, iMessage, Meet and others
Issued 17 Aug 2026; anti-government-spoofing 30 Sep 2026; rest 31 Jan 2027
Hong Kong
Recommends a human-in-the-loop approach for agentic-AI decisions with significant impact on individuals
Published 25 Aug 2026
Not law — shown for direction of travel.
Not law — shown for direction of travel.
Japan
Principles-based, guidelines-led AI framework; basis for assessing deepfake harms
Enacted May 2025; in force Sept 2025
Japan
APPI (amendments 2025–26); My Number
Personal-data protection reform for AI/data use; national digital identity (My Number)
APPI amendment bill 2026
India
Label synthetic media + provenance; 3-hour takedown; prohibit impersonation/fraud deepfakes
Notified 10 Feb; in force 20 Feb 2026
India
DPDP Act 2023; Aadhaar
Data protection; national digital identity
DPDP rules 2026; Aadhaar operational
China
Explicit + implicit labels / watermarks on all synthetic media
Released 14 Mar 2025; effective 1 Sept 2025
South Korea
Transparency / watermark for AI content hard to distinguish from reality
Enforcement from Jan 2026
Latin America
Jurisdiction
Instrument
What it requires
Status & key dates
Brazil
Data protection; risk-based AI bill; electoral deepfake ban; PIX fraud controls
LGPD in force; PL 2338 passed Senate Dec 2024, pending Chamber
Mexico
AI framework incl. deepfake / misinformation safeguards
Under Senate committee; approval expected 2026
Argentina
Would criminalize harmful AI-generated content (up to 6 yrs)
Proposed 2025–26
Middle East & Africa
Jurisdiction
Instrument
What it requires
Status & key dates
UAE
Cybercrimes Law (34/2021); PDPL; DIFC Reg. 10
Criminalizes harmful deepfakes; protects biometric data; AI regulation (DIFC)
In force; DIFC Reg. 10 enforced 1 Jan 2026
UAE
CBUAE authentication mandate; UAE Pass
Phase out SMS/email OTP; risk-based MFA + facial biometrics + Emirates ID; national digital ID
By Mar 2026
Saudi Arabia
PDPL; Deepfakes Guidelines
Data-protection enforcement (SDAIA); deepfake governance framework
PDPL enforced; guidelines issued
Nigeria
Cybercrime framework; proposed AI/algorithm oversight; deepfake-fraud amendments mooted
Act in force; AI bill proposed 2026
South Africa
Criminalizes malicious/deepfake intimate-image disclosure; data protection
In force
International coordination
The FATF 2026–2028 Fraud Roadmap ↗ (under the UK's presidency) makes fraud a headline priority — fraud is now the predicate offense in roughly 90% of FATF mutual evaluations. The Interpol / UNODC Global Fraud Summit (Vienna) coordinates action on transnational scam networks.
On 21 September 2026, 31 leaders of 29 countries and the European Commission — Australia among them — signed A Call for Control of Frontier AI Models ↗: "AI must remain under human direction, oversight and control." The same day, the UN's Independent International Scientific Panel on AI published its first brief, on AI agents and the risk of losing human control.
The laws specify the outcome — establish that a real human is involved — and leave the method open.
A neutral tracker of scam-prevention, anti-impersonation and digital-identity law worldwide. Last updated 2 October 2026.