Building the future of finance in the age of AI

The Mills Review

That is why we commissioned the Mills Review[3], published in July, focused on how AI could reshape retail financial services by 2030.

Some developments we anticipated are already emerging, including the transition towards agentic finance, such as the launch of Meta’s Muse.

Our response to the review is not to consult, study and report progress. Our focus is testing, assurance, monitoring and surveillance: directly with industry to understand how AI systems are being deployed.

Whilst the Review focused on retail, the AI shift does not stop at the retail boundary. Across wholesale markets too, AI is accelerating how firms analyse, trade, monitor and make decisions.

We are embedding 6 of the 7 recommendations into live work immediately. Our innovation services[4] such as the AI Lab[5] give us direct insight into what firms are building from agent-led payments and fraud detection to consumer support.

On frontier AI security, we are working directly with banks to understand how frontier models are changing cyber defence, identifying and linking vulnerabilities and assisting with triaging, patching and recovering at greater speed. Those insights are feeding directly into our supervisory and policy response.

Firms are not bystanders in that process. The leaders will be those that deploy AI effectively, innovatively and safely.

But increasingly, AI is also changing what happens before a consumer ever reaches a regulated firm. Consumers are turning to general-purpose large language models (LLMs), like ChatGPT, Gemini and Claude, for financial information and advice, while regulated firms are beginning to integrate their services into AI platforms.

The good news – this can significantly widen access to financial tools and information. But it can also blur the boundary between regulated and unregulated activity, and the protections consumers receive.

Four in five less-experienced investors aged 18-40 have used AI to help with investing, but only 40% of consumers correctly recognise that there is no recourse if something goes wrong after acting on advice from a general-purpose AI tool. Our answer is not simply to expand our remit, but to make the existing boundary clearer.

Through InvestSmart[6] and the FCA Firm Checker[7], we already help consumers understand the protections they have. But warnings may be more effective at the point where AI-generated financial information is delivered.

So we are calling on AI providers to help consumers understand the limits of financial information and advice generated by their models through clear, proportionate and consistent disclaimers.

And rather than create a new public-interest financial capability tool, as the Mills Review suggested, we will build on existing work, including IOSCO’s first TechSprint, powered by our AI Lab to help investors spot scams, verify information and challenge unreliable AI outputs.

AI adoption: good and poor practice

Protecting consumers starts with how firms deploy AI.

Today, we are publishing good and poor practice[8] drawn from our observations from firm testing this year, to give practical guidance and examples.

Three things stand out: consumer centricity, accountability and governance, and operational resilience.

Put the consumer first

The Consumer Duty[9] provides an outcomes-based regulatory framework. We’ve seen firms using AI for inclusive product design, clear consumer choice, and a path to speak to a person. Good practice: one firm developed a live list of vulnerability signals that its chatbot can use to flag consumers who may need additional support to human advisers.

But we have seen poor practice too: firms developing AI tools without a clearly defined need, excluding vulnerable consumers by default, overstating capabilities, or deploying automated customer journeys without sufficient testing.

AI should improve consumer outcomes, not simply automate existing processes.

Know who is accountable

The second principle is governance, where too many firms are still under-investing.

Firms need clear accountability, risk-based controls, human oversight, escalation triggers, and senior managers personally accountable for AI systems.

We have seen good examples. One firm established an independent ethics panel to interrogate proposed AI use cases before deployment – including ownership, bias, and controls. But we have also seen firms retrofit governance after technology has already been deployed or fail to adapt monitoring as systems change.

That is the wrong way around.

Operational resilience

Third: stress-test AI systems. Plan for failure. Maintain fallback options. Understand supplier concentrations and dependencies, including reliance on a single model. A system that fails at scale disrupts the services consumers rely on. Make sure you have proper cyber insurance in place.

Overall, our good and poor practice finds that both firms and consumers benefit from well-deployed systems. Even AI deployed purely for internal efficiency passes value to consumers – through better-run firms, more competitive pricing, and faster service.

Our good and poor practice, published today, is not intended to be static guidance – we will update it as the technology evolves.

From frontier AI to agentic finance

And the frontier is moving quickly – shifting from technology that helps us understand and decide, to technology that can increasingly act on our behalf.

Agents can search across products, manage payments and investments, and transact directly with other agents, creating a new layer of autonomous technology between institutions and their customers. With its strengths in fintech and financial services, the UK can lead this next wave.

But greater autonomy also changes the risk.

Poorly governed AI can create consumer harm, cyber vulnerabilities and operational failures, potentially at much greater speed and scale.

That is why firms need to invest now in cyber and operational resilience. Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses. As the AI Minister has recognised, near-miss reporting for agentic AI is becoming a national security priority. It is a regulatory priority too.

It also means thinking differently about assurance. A system that is safe at deployment may behave differently at scale, under stress or as the models beneath it change. Agentic systems therefore require continuous, conditional assurance.

The FCA will work with industry, fellow regulators and frontier labs to develop a trusted framework for agentic finance, including clear approaches to agent identity, delegated authority, accountability and execution.

Our aim is to create the conditions in which agentic finance can thrive, with innovation and consumer protection built together from the start.

Becoming an agentic regulator

And the FCA itself is changing. Part of our work to become a smarter regulator means developing our future as an agentic regulator, using the same technologies reshaping our markets to make ourselves sharper, faster, and more effective.

Across the FCA we are deploying AI to scale our operations and focus on the greatest harms, upskilling staff and investing in technology. AI can gather evidence, surface intelligence from disparate sources, and flag early warning signs so we can act at pace.

For example, we are building AI tools for the oversight of 60,000 anti-money laundering (AML) firms coming into the FCA’s remit in 2028. We are deploying automation and building AI agentic tools – like our market first responder agent – which will supervise ~9,000 small wholesale markets transaction reporting firms, so supervisors can prioritise more complex supervisory activities.

Dynamic data collection becomes part of the future of supervision. Building on our launch in August of the FCA’s Handbook API, giving access to firms to digest our machine-readable rules via their AI tools, we are also working on machine-readable data collection APIs.

And leveraging our AI Lab and Sandbox environment becomes ever more important for system-wide simulations and method of supervision.

Conclusion

I began by saying it was good to be here among humans. While that was light-hearted, there is a serious point behind the work we must do together.

AI is moving faster than any regulatory framework was designed. That means regulators will increasingly need to make judgements without precedent, while ensuring that trust remains at the heart of financial services.

We remain focused on our strategy[10], becoming a smarter regulator, using technology to become faster and more effective, enabling markets that work well – for consumers, for growth, and for the long term.

Building on our world-leading approach to innovation and proportionate regulation, we believe developing the best approach to deploying AI safely is what will differentiate the UK market.

The future of finance is being built now. Let's build it together.