FCA’s Mills Review Casts AI as Part of the Financial System, and Asks Whether the Rules Still Fit
The FCA’s independent review into the long-term impact of artificial intelligence on retail financial services, published on 6 July, looks out to 2030 and sets seven recommendations for the regulator. The specialists who responded welcomed its direction, while pressing on the regulatory perimeter, on accountability as AI
begins to act on its own, and on the consumers most exposed if it goes wrong.
The Financial Conduct Authority (FCA) has published the Mills Review, its independent look at how advanced artificial intelligence could reshape retail financial services out to 2030 and beyond. Led by the FCA’s executive director Sheldon Mills and commissioned by the regulator’s Board, it is described as the first review of its kind initiated by a financial regulator anywhere in the world. It identifies four AI-driven shifts, in how firms operate, how consumers make decisions, how firms compete, and in the amplification of fraud and cyber risk, and it makes seven recommendations to the FCA, from securing and adapting the regulatory perimeter to scaling up the regulator’s AI Lab and laying the foundations for what it calls agentic finance.
One figure runs through much of the reaction. Research commissioned for the Review found that around one in five people, some 11 million UK adults, are likely to use AI that can act autonomously within goals they set. That prospect, of software acting on a customer’s behalf rather than simply informing them, is what most of the specialists who responded chose to focus on.
Charlotte Byrne, AI Lead at the consultancy Capco, read the Review as a change in the regulator’s stance. “The Mills Review marks an important shift in the FCA’s thinking,” she said. “While until now, much of the conversation has been about how firms can adopt AI safely, this report goes further, clearly recognising that AI is becoming part of the financial system itself.” The finding that one in five consumers would consider agentic AI for financial decisions was, she said, significant but easy to misread. “It’s important to distinguish
between curiosity and trust. Consumers will not judge AI on how intelligent it is, they will judge it on whether it delivers high quality outcomes consistently.” She welcomed the fact that the FCA had not proposed a separate AI rulebook, choosing instead to build on existing principles such as the Consumer Duty, which has governed firms since 2023. The harder task now, she said, was operationalising those principles from design through to monitoring.
The perimeter question
For lawyers advising firms, the Review’s central provocation is about the boundary of regulation itself. “The report shines a light on a fundamental regulatory question,” said Jonathan Herbst, Global Head of Financial Services at Norton Rose Fulbright. “If consumers increasingly rely on AI systems provided by a small number of major technology companies to make financial decisions, how should existing regulatory frameworks adapt?” The Review, he noted, stops short of proposing action against large technology providers. “Mills is not proposing an immediate crackdown on Big Tech, but he is asking whether the rules need to evolve to reflect how financial services are actually being delivered.”
His colleague, partner Matthew Gregory, said the seven recommendations would shape the framework at pace. Mapped against a spectrum of AI autonomy, he said, the report singles out operational resilience and the regulatory perimeter as the near-term pressure points, and calls for the FCA to consider an urgent review to secure and adapt that perimeter and to lay the foundations for agentic finance. A substantial new phase of regulatory work, on his reading, now follows.
Where the Review touches the mechanics of oversight, practitioners pressed for proportion. Sally Hodgin, Principal AI Consultant at Connect, warned against treating all AI as one risk. “A publicly available, general-purpose LLM influencing a consumer’s financial decision presents a very different risk profile from a constrained, task-specific system operating within a regulated firm’s controlled environment,” she said. The questions that should set the level of oversight, she argued, were practical ones: “What data can the AI access, what actions is it authorised to take, how consequential is the outcome, and can the firm explain,
test and audit its decisions.”
That accountability gap is already visible in commerce, according to Emma Banymandhub, CEO of The Payments Association, who pointed to the body’s own research on agentic purchasing. “Merchant adoption of AI-led purchasing is accelerating faster than the liability and authentication frameworks needed to support it,” she said. “We found that 58 per cent of UK online merchants believe AI agents have already transacted on their platforms, yet only 41 per cent are confident in the liability frameworks governing those transactions.” Firms, she said, should treat agentic AI as an accountability and governance issue now rather than later.
For Nejc Korosec, Head of Compliance at the data platform Moneyhub, the Review’s value was in naming a less glamorous dependency. “An AI agent can only act in a consumer’s best interest if it has an accurate, real-time picture of that consumer’s financial life,” he said. “Without good data, personalisation is just guesswork with better presentation.” He tied the point to Open Finance and to the sums sitting idle in the system. “The advice gap, the protection gap, 300 billion pounds sitting in low-interest accounts are all data problems as much as they are education and guidance problems.”
The consumers most exposed
The most pointed warnings were about who is protected as AI moves into financial decisions. Amal Jolly, CEO of the compliance technology firm Saturn, put the imbalance starkly. “In financial services, AI is the new Wild West: consumers are left with no protection,” he said. “Only 9 per cent of people have access to regulated human financial advisers, but 100 percent of people have access to ChatGPT and other AI platforms.” His answer was to lower the cost of delivering regulated advice so that more people could reach it, rather than leave them with unregulated tools.
James Towner, Chief Growth Officer at ArvatoConnect, drew on his firm’s survey of finance leaders to argue the industry is not yet ready. “If firms don’t lead with the customer outcome, and innovation races ahead of consumer protection, the result will be exclusion and entrenched bias,” he said. More than three-quarters of the finance leaders surveyed believed their AI strategy could exclude vulnerable customers, he noted, yet only a quarter test their systems against real-life vulnerability. What people want before they will trust AI with their money, he said, is clear protection when things go wrong and the ability to reach a human.
Sophie Legrand-Green, Head of Policy for Consumer Protection and Access at The Investing and Saving Alliance, made the same conditional case. “AI could widen access to financial support, but only if consumers can trust the tools in front of them,” she said. As tools begin to make recommendations or act on a consumer’s behalf, she argued, protections, accountability and redress have to keep pace, and the systems must be “tested against real consumer risks, including vulnerability, comprehension, bias and access to redress, before they become embedded in everyday financial decision-making.”
The seven recommendations now sit with the FCA’s Board and executive to weigh. Among them are a commitment to secure the regulatory perimeter, to scale the regulator’s AI Lab, to build AI-enabled supervisory tools, and to develop a public-interest financial capability service. The Review sets no firm implementation dates, but on the reading of those who responded, the question it forces, of how far the existing rulebook stretches as software starts to act for consumers rather than merely advise them, will not wait until 2030 to be answered.
