Rethinking regulation for the age of AI

On joining the FCA over five years ago, I said we would become as much a data and tech regulator as financial services regulator.

Being invited to speak here today reflects that.

We’re building the future together, and nowhere is that clearer than on AI.

Studies suggest more than 80% of financial services firms are already adopting AI.

So the question now is about scale.

And if we are serious about being a leading AI economy, financial services have to sit at the heart of our approach.

Only financial services can provide the investment, infrastructure, and trust that will accelerate AI adoption across the economy.

But with the pace of change brought about by AI challenging many of the assumptions on which our markets and regulation were built, the question isn’t simply how we regulate for AI.

It’s how do we preserve trust, competition, and resilience when technology is moving markets dramatically faster than the frameworks governing them?

What does scaling look like?

Two big scaling opportunities stand out.

First, agentic systems.

The AI conversation has focused on what generative AI can help us summarise, detect, or automate.
The next phase will be quite different: systems that don’t just support financial decisions, but coordinate and transact.

In retail markets, that could mean smarter bill management, personalised investment strategies, less friction.

In wholesale markets, agentic systems supporting liquidity management, trading workflows, and  other market functions.

A profound step change to the structure and operation of markets.

But investors will be wary to delegate important decisions to systems they don't understand.

Accountability for regulated activities and outcomes must remain clear. Designed with the right human oversight, and in a way that gives consumers confidence to engage.

The second key development is tokenisation.

Tokenisation has huge potential to lower costs, reduce risk and unlock new services - providing the more automated and programmable infrastructure that agentic finance demands.

With banks already piloting tokenised deposits, which could reduce friction and fraud risks in processes like home buying.

And on Monday, we approved Baillie Gifford, alongside Bank of New York Mellon, to launch the UK’s first natively tokenised authorised fund.

The entire transaction journey, end-to-end, on chain.

With the Bank of England (the Bank), the FCA has set out a direction for tokenised wholesale markets. Do answer our Call for Input[2] to help shape our approach, which closes next week.

A different approach to regulation

But rapid AI progress also raises more fundamental questions.

Technology is moving much faster than many regulatory paradigms. Legislation will never keep up.

That is one reason the FCA’s Strategy is built around rebalancing risk.

We are re-thinking what it means to be an effective regulator in the age of AI. 

How we supervise, gather intelligence, collaborate, and innovate.

We are exploring agentic AI as our ‘first responder’ to speed up how we monitor wholesale markets. 

Harnessing technology and our large data sets – a billion rows of data per day - alongside our supervisory judgement to tackle market abuse faster.

In some areas, we will still need detailed rules. But in others, traditional rule-making simply won’t work anymore.

A growing part of our role will be stewardship, as well as supervision. 

Helping firms and markets navigate technological change, and working more collaboratively and creatively to understand emerging risks.

Even acting before legislation catches up.

Take Buy Now Pay Later - it took about six years to come into our regulatory perimeter, but we did not wait six years to intervene.

And it also changes how we think about competition.

AI lowers barriers to entry and creates opportunities for challengers to establish at speed. We welcome that.

Our role is not to protect incumbents, but to ensure competition works as it should – in the interests of consumers and the economy. 

Some firms may fall behind the pace, while others rapidly rise. 

A transition that might feel bumpy at times, but we will remain focused on market integrity as things unfold.  

And as markets move faster, our competition objective and system-wide powers become vastly more important. 

We should expect to use these system-wide powers more frequently – not as exceptional interventions, but as a regular part of our toolkit. Whether under the Enterprise Act, the Digital Markets, Competition and Consumers Act, or beyond.

There will be times where collaboration between firms will be vital.

In Open Banking, we have considered the case for beneficial collaboration under competition law, so commercial Variable Recurring Payments can get off the ground. 

And we’re open to other areas where we may need to play a facilitating role, be that in data sharing on Open Finance or frontier AI.   

As today’s publication from the Digital Regulation Cooperation Forum[3] makes clear, responsible innovation is very much a design choice.

Resilience

Financial services are increasingly reliant on cloud providers, model providers, data providers. Many parts of the AI stack.

As those links grow, so do opportunities and risks: for systemic resilience, market integrity, and financial crime.

UK Finance’s Annual Fraud Report[4] suggests the UK lost almost £1.3 billion through payment fraud last year, with two-thirds of authorised fraud cases coming via social media sites and messaging platforms.

Fraud increasingly sits at the intersection of financial services, technology, and telecoms. Tackling it requires a different model of collaboration.

Our work with Ofcom on the Online Safety Act and related Codes is particularly important.

And we expect tech firms to step up to stop criminals exploiting their platforms.

Frontier AI could magnify risks even further.

Last year, 98% of operational incidents reported to us related to technology and cyber issues. 

Faster, more capable models might help firms identify vulnerabilities and strengthen defences, but they could also help attackers do the same.

Enabling cyber threats to spread much more quickly.

Boards and leadership teams must understand the risks. 

Dependencies - particularly on model providers and third parties - must be properly mapped and governed, and the Critical Third Parties regime becomes more important than ever. 

Resilience will also increasingly become a national security and system-wide challenge. 

There will be risks that no one firm, regulator or sector can fully see, so we need to share information better.

One of the FCA’s distinct responsibilities is competition law compliance for all regulated financial services firms. 

There may be circumstances where banks, commercial entities and other authorities need to share intelligence in order to defend the system as a whole. Frontier AI is an obvious example.

The FCA will be pragmatic in facilitating and encouraging that where appropriate.  

It’s important that firms keep engaging with us promptly - including on any competition law concerns – to help us understand where the risks and barriers are.

How the FCA is supporting

The themes emerging from techUK’s report around collaboration, shared infrastructure, and investment in the AI supply chain are particularly welcome.

The philosophy of the report already informs how we are working at the FCA.

We want to make it easy to safely build, test and scale AI in UK financial services.

Through our Supercharged Sandbox[5] - where firms can build and test solutions using real-world data, compute and systems, working with partners like Nvidia, and soon Google.

Our AI Lab[6] - where firms can experiment and scale in payments and e-commerce. We recently added a dedicated Agentic Academy. 

And the AI Consortium with the Bank, which brings together firms and tech providers to work through challenges collectively. 

You’ll see more from us soon.

In a couple of weeks, the Mills Review, setting out how AI could re-shape retail financial services. Followed by a publication on good and poor AI practice later in the year.

But we know that our regulatory approach can’t be designed first, consulted on later.

Many challenges to scaling - like data availability or integration challenges - will be best understood by the people in this room.

We need to build it with you.

Closing

Because the question for the UK is not whether AI will reshape financial services. It is, and it will.

It’s whether we are the place where AI is scaled. In a way that is safe, responsible and commercially viable.

Success will be about harnessing the extraordinary talent in our science base and financial services.

While making sure markets are open to competition, the system is resilient, and regulation is fit for the world we live in. 

That’s why we’re re-thinking what effective financial services regulation looks like in the age of AI. 

Not to stand in the way of innovation, but to support the UK to seize the opportunity.