FinTechReview Prompt

Compliance Prompt for HKMA Deepfake Video Onboarding Audit

This **Arc** review prompt takes your remote video onboarding endpoints and the **HKMA supervisory guidance on AI deepfake detection** for banking, then audits each endpoint and configures the gateway checks that enforce it. Arc, the deepidv credential gateway, returns an HKMA control map that rates each endpoint against the guidance sections, a camera-attestation configuration that gates every mobile intake session on a hardware enclave signature and drops unsigned or emulated streams before liveness runs, a passive-liveness spec that fits the sub-150ms budget with named anomaly conditions, and a gating spec that says exactly which intake sessions hold before they pass to processing. Built for compliance and onboarding leads at banks and fintechs running remote video onboarding for Hong Kong customers who must defend intake against injected synthetic media, not just presentation attacks.

How to use this prompt

1
Open Arc in the deepidv dashboard and paste the full prompt, or run it in Claude, ChatGPT, or Gemini if you are drafting the onboarding audit outside the platform.
2
Replace the INPUT section with your remote video onboarding endpoints, the attestation and liveness checks each runs today, your intake latency budget, and the HKMA guidance sections you have reviewed.
3
Run the prompt and read the HKMA control map first: every guidance control is rated covered, partial, or gap with the evidence behind the rating.
4
Hand the camera-attestation configuration and passive-liveness spec to your mobile onboarding engineer, and route the control map to your MLRO; start with any control rated gap.
5
Re-run the audit after each intake-SDK change and after the HKMA publishes new guidance so the design stays aligned before your next supervisory review.

The prompt

Arc, audit our remote video onboarding endpoints against the supervisory guidance issued by the HKMA. Configure the system to enforce hardware enclave camera attestation and sub-150ms passive liveness checks on all mobile user intake sessions.

ROLE
You are Arc, the deepidv credential gateway. You audit the onboarding intake path against a named supervisory standard, then configure the gateway checks that enforce it before any capture is trusted.

CONTEXT
The Hong Kong Monetary Authority has issued supervisory guidance on AI deepfake detection for banking, pressing authorized institutions to defend remote video onboarding against injected synthetic media rather than only presentation attacks. Injection attacks pipe a generated video into the intake SDK through a virtual camera or modified driver, so a passive liveness check on the pixels alone is not enough. Defense depends on binding each mobile intake session to a hardware enclave attestation and running passive liveness inside a sub-150ms budget at the gateway.

INPUT, the user will paste:
- The remote video onboarding endpoints and the mobile intake flow each runs
- The camera attestation and liveness checks each endpoint runs today, and where in the flow they sit
- The HKMA guidance sections the firm has already reviewed
- The latency budget for intake liveness checks
- Any known injection vectors or device-posture gaps the fraud team has seen

TASKS
1. Audit each remote video onboarding endpoint against the HKMA supervisory guidance and rate its coverage.
2. Configure hardware enclave camera attestation as a gate on every mobile intake session, so an unsigned or emulated stream is dropped before liveness runs.
3. Configure passive liveness to run inside the sub-150ms budget on all mobile intake sessions, with the anomaly conditions that route to review.
4. Produce a gating spec that says exactly which intake sessions hold before they pass to processing, by risk tier.

OUTPUT FORMAT, return the following structured response:

1. HKMA CONTROL MAP
- Each control the guidance sets, with the section reference
- Current endpoint coverage rated covered, partial, or gap, with the evidence

2. CAMERA-ATTESTATION CONFIGURATION
- The hardware enclave attestation gate placed at intake, and the drop rule for any unsigned or emulated stream
- Where the attestation step sits in the flow, ahead of liveness and any biometric match

3. PASSIVE-LIVENESS SPEC
- The passive liveness check on every mobile intake session and its placement against the sub-150ms budget
- The anomaly conditions that mark a session authentic, suspect, or rejected

4. GATING SPEC
- The exact conditions under which an intake session holds before it passes to processing, by risk tier
- The escalation and manual-review routing when an attestation or liveness check fails
- The evidence bundle retained per rejected session for a supervisory inquiry

Be specific about ordering and drop conditions, and cite the guidance section references where you can. Where the firm input is insufficient to assess a control, flag it as an open question instead of guessing.

Test it in Claude or another LLM

This prompt is built for the Arc agent inside deepidv, where Arc audits a firm's live remote video onboarding endpoints against the HKMA supervisory guidance and enforces hardware enclave camera attestation and passive liveness at the gateway. You can dry-run the same workflow in any general LLM first with synthetic endpoint and latency data to see the control map and configuration before wiring it to real intake.

1
Paste the full prompt into Claude, ChatGPT, or Gemini, but replace the opening 'Arc,' with a role instruction such as 'Act as a KYC onboarding architect auditing remote video onboarding endpoints against the HKMA supervisory guidance on AI deepfake detection.' Keep the four OUTPUT sections exactly as written.
2
Under the INPUT section, paste the synthetic sample block below so the model has onboarding endpoints, current checks, and a latency budget to audit.
3
Add one framing line: 'This is synthetic test data. Where a control cannot be assessed from the input, flag it as an open question instead of guessing, and never claim coverage the input does not support.'
4
Check the output shape: an HKMA control map with covered/partial/gap calls, a camera-attestation configuration that gates every mobile intake session and drops unsigned streams before liveness, a passive-liveness spec placed against the sub-150ms budget, and a gating spec. If any section invents a control the input does not list, tighten the role line and re-run.
5
Once the output shape is right, run it live in the deepidv dashboard where Arc enforces the attestation gate and passive liveness on your real intake endpoints.

Synthetic sample data to paste alongside the prompt

Fake test data, safe to share with any LLM. Swap in your own once the output looks right.

REMOTE VIDEO ONBOARDING ENDPOINTS (synthetic, fake):
- App: ACME-HK-TEST, mobile intake for retail HKD accounts
- Intake flow: launch camera, capture selfie video, run liveness, run document scan, submit
- Current checks (fake): passive liveness on pixels only; no hardware enclave attestation; jailbreak flag only, no virtual-camera detection
HKMA SECTIONS REVIEWED (fake): deepfake-detection ref HKMA-TEST-2026-04; camera-integrity ref HKMA-TEST-2026-06
LATENCY BUDGET (fake): intake liveness hard cap 150ms; capture stage soft cap 4000ms; peak 300 intakes/hour
KNOWN VECTORS (fake): OBS virtual camera driver, one commercial face-swap app, emulator with spoofed camera
OPEN ITEM (fake): fallback path for devices without enclave attestation undecided, fake ref FALLBACK-TEST-XX

Pairs with on deepidv

Sources & further reading

FAQ

What does the HKMA guidance on AI deepfake detection require?

The Hong Kong Monetary Authority guidance presses authorized institutions to defend remote video onboarding against AI-generated deepfakes and injected synthetic media, not only physical presentation attacks. In practice that means verifying the camera pipeline and running liveness that catches injected streams at mobile intake. This prompt maps your endpoints to those expectations and configures the checks that satisfy them.

Why gate on hardware enclave attestation before liveness?

Injection attacks pipe a generated video into the intake SDK through a virtual camera or modified driver, so a liveness check on the pixels alone can pass a flawless synthetic face. Gating each mobile intake session on a hardware enclave signature drops an unsigned or emulated stream before any liveness or biometric analysis runs, which is cheaper and far harder to defeat than post-capture inspection.

Does this apply to institutions outside Hong Kong?

Any institution running remote video onboarding for Hong Kong customers is expected to align with the HKMA guidance. Arc audits the endpoints regardless of where the firm is domiciled and flags the controls where the intake stack falls short of the supervisory floor.

Can I use this prompt outside the deepidv dashboard?

Yes. The structure works in Claude, ChatGPT, or Gemini as an audit-design framework and returns the control map, attestation configuration, liveness spec, and gating spec. Live attestation and liveness enforcement on your real intake endpoints only works when it runs inside the deepidv dashboard through Arc.

Run it with live verification data

These prompts work in any LLM. Inside the deepidv dashboard, Luna, Arbiter, and Arc run them against your real sessions, screening lists, and audit trails.

Book a Demo