The future of AI regulation in UK financial services: key insights from the FCA's Mills Review
On 6 July 2026, the Financial Conduct Authority (FCA) published what is likely to be one of the most consequential reviews for AI regulation in UK financial services.
The Mills Review (the Review), Artificial Intelligence (AI) and the future of retail financial services, sets out how AI could fundamentally reshape the delivery and use of financial services by 2030. Commissioned by the FCA Board and led by outgoing Executive Director Sheldon Mills, the Review explores four systemic shifts driven by AI across firms’ core functions and operations, consumer journeys, market competition, and fraud and cyber risk. To respond to these, it sets out seven recommendations on how the FCA’s approach to AI should evolve to remain fit for purpose, with direct implications for how firms can expect to be regulated and supervised in the future.
The Review notes how quickly AI has evolved since its work began in late 2025, including developments in frontier AI models. This highlights the core challenge for regulators: in the words of FCA Chief Executive Nikhil Rathi, “technology is moving much faster than [...] regulatory paradigms”.
Even without imminent AI-specific rules, supervision is likely to change quickly and feel very different. The AI-enabled, agentic supervisory model proposed in the Review, which the FCA indicated during the Review’s launch event that it expects to move towards, would reshape how the regulator monitors firms and challenges outcomes. Governance, accountability, risk management, and consumer and market outcomes are all likely to face agentic supervisory scrutiny, supported by the FCA’s growing capability to analyse firm and market data more quickly, systematically and at scale.
In brief: key messages
1. AI will drive four systemic shifts that will reshape financial services
- AI will transform firms’ core functions and operations - Firms are already piloting more autonomous AI use cases and, by 2030, many could use AI across core functions such as customer support, underwriting, compliance, claims and product design. For leading firms, AI could become central to how they process information, serve customers and evidence outcomes. As AI takes on more decisions, a firm’s governance framework will need to set out who is accountable, for what, and how that accountability works in practice.
- Agent-led consumer journeys - Consumers are likely to rely more on AI agents to make or manage financial decisions. Adoption will depend on trust, access and user control. Unequal access to high-quality AI could widen inclusion gaps, while unchecked hyper-personalisation may increase risks of bias, opaque pricing and personalised manipulation.
- A reshaped competitive landscape - Market power may shift towards those controlling the AI-mediated consumer interface, rather than the financial product itself, weakening firms’ direct customer relationships. Reliance on a small number of model providers and hyperscalers also raises concentration, lock-in and data sovereignty risks that firms will need to manage.
- Amplified fraud and cyber risks – AI will make fraud more convincing, scalable, and harder to detect, including through deepfakes, synthetic identities and personalised social engineering. It also enables attackers to find and exploit vulnerabilities in firms’ infrastructure at a speed and scale that traditional defences cannot match. Both threats require defensive capability and cross-sector intelligence sharing to evolve as quickly as the attacks.
2. Seven recommendations to make the FCA fit for (future) purpose.
Against that backdrop, the Review concludes that the regulatory and supervisory framework needs to evolve. The Review agrees that the FCA’s existing technology-neutral and outcomes-based framework, including the Consumer Duty, the Senior Managers Regime and operational resilience, remains a sound foundation. However, it also flags that it will come under increasing pressure as AI becomes more autonomous and the AI-driven market transformation described above accelerates. The Review’s seven recommendations (set out below) are therefore aimed at keeping the framework fit for purpose in an AI-enabled financial system, while supporting innovation and managing risks to consumers, firms and the wider market.
3. The recommendations are not yet FCA policy, but they signal a shift in regulatory thinking.
The FCA Board will need to consider the Review’s seven recommendations and decide whether, and how, to take them forward. Even so, they provide a clear indication of how the FCA’s approach to AI may evolve in the coming years. The Review should also be read alongside recent remarks by FCA Chief Executive Nikhil Rathi and Bank of England (BoE) Deputy Governor Sarah Breeden. Taken together, they suggest a shift in UK regulatory thinking, including a growing recognition that targeted AI-specific interventions may be needed to secure the regulatory perimeter, strengthen supervision, and address selected areas of regulation as AI becomes more autonomous and agentic.
4. Strong AI governance is a strategic capability, not a compliance function.
The Review is explicit that effective AI governance underpins the safe adoption of AI and can become a source of competitive advantage. As AI becomes more autonomous and takes on more decision making, approval at launch followed by periodic reviews will no longer be sufficient. Governance and oversight will need to operate closer to real-time, alongside the AI systems they govern. Firms that build this capability now will be able to deploy AI at greater speed and scale and adapt quickly to future regulatory and supervisory changes, including agentic supervision. They will also be better able to demonstrate that AI-driven or AI-informed decisions are delivering the intended outcomes.
The Review’s seven recommendations to the FCA Board: high-level summary
The Review stresses that the recommendations are mutually reinforcing. Together, they aim to support safe innovation, stronger oversight and better outcomes in an AI-enabled financial system.
|
Recommendation |
High-level summary |
|---|---|
|
1. SECURE AND ADAPT THE REGULATORY PERIMETER |
Within three to six months, the FCA should review the scale, nature and impact of general-purpose large language models operating outside the regulatory perimeter, including how consumers use general-purpose AI tools for savings, investments, pensions, mortgages and debt. It should then decide whether to amend guidance, recommend perimeter changes to government or maintain the current approach.
Longer term, the FCA should monitor how frontier model capabilities affect the activity-based perimeter and consider asking government to strengthen powers under the Critical Third Party and Designated Activities regimes, which can bring specific financial activities within FCA rules even where the provider is not otherwise regulated, and grant the FCA direct powers under the Digital Markets, Competition and Consumers Act.
|
|
2. STRENGTHEN SYSTEM-WIDE COORDINATION AND OVERSIGHT |
The FCA should enhance coordination across domestic authorities and international partners covering resilience, data, competition, security and consumer protection. Key actions include strengthening the BoE/FCA AI Consortium; improving intelligence-sharing on fraud and cyber risks including engagement with the AI Security Institute; and deepening cross-sector collaboration through the Digital Regulation Cooperation Forum.
|
|
3. MONITOR THE TRANSITION TO AUTONOMOUS MODELS AND ADAPT REGULATORY FRAMEWORKS |
The FCA should monitor the shift towards more autonomous AI and adapt accountability, governance and consumer protection frameworks accordingly. As consumer journeys increasingly involve interconnected AI systems across firms and third parties, traditional point-in-time model validation becomes insufficient.
The FCA should clarify how Senior Managers Regime obligations and Consumer Duty apply where opacity, model drift and distributed decision-making make it harder to evidence outcomes or identify the source of harm. |
|
4. SCALE UP THE FCA'S AI LAB TO SUPPORT AI MODEL AND SYSTEM INNOVATION IN FINANCIAL SERVICES |
The FCA should establish a structured capability, anchored in its AI Lab, to assess AI models and systems used in financial services, covering current general-purpose and domain-specific models, with the strongest emphasis on emerging architectures and more capable models.
Working with firms, developers, researchers and technical experts, the aim is to develop an independent understanding of AI models, address challenges around explainability, assurance and governance, and support responsible growth. For example, earlier dialogue with model developers would allow the FCA to assess how emerging architectures handle opacity and auditability before they become embedded in core firm operations. |
|
5. ENABLE THE FOUNDATIONS FOR AGENTIC FINANCE |
The FCA should lead the development of a trusted framework for AI agent participation in financial services, clarifying how agents can be authorised, identified and held accountable, with clear expectations for consent mandates, identity, control and liability.
The Review recommends using the FCA's Open Finance work to build standardised approaches for AI agents acting with Open Finance data, with a separate industry committee set up with regulatory input. For example, without standardised delegation and consent frameworks, an agent instructed to switch a consumer's savings product across providers cannot safely execute that instruction end-to-end. |
|
6. BUILD AND ADOPT AN AI-ENABLED AGENTIC SUPERVISORY MODEL |
The FCA should develop an AI-enabled agentic supervisory model enhancing firm-by-firm regulatory efficiency and system-wide oversight across the full regulatory lifecycle - from authorisation through supervision to enforcement - while building on rather than replacing human-led judgement.
The FCA should use AI to support supervisors by analysing information and suggesting actions, while keeping human supervisors responsible for approving and making key regulatory decisions. For example, aggregated monitoring of Consumer Duty outcomes across firms could surface harms that no single firm's internal data would reveal, enabling faster, more targeted supervisory intervention. |
|
7. DEVELOP A TRUSTED PUBLIC-INTEREST AI-ENABLED FINANCIAL CAPABILITY SERVICE |
The FCA should convene the development of a free, inclusively designed, trusted AI-enabled financial guidance and support service, providing consumers with access to reliable financial information from trusted sources regardless of ability to pay.
|
Conclusion
The Mills Review sets out an informed projection of how AI will evolve and shape financial services by 2030, grounded in extensive industry engagement and consumer research. It makes recommendations to the FCA Board on how the regulatory and supervisory framework may need to adapt. While not yet FCA policy, the Review is an influential signal of the emerging regulatory thinking and points to the areas where firms can expect greater supervisory scrutiny and challenge as they scale AI.
Suchitra Nair
