The UK Financial Conduct Authority (FCA) has published The Mills Review (the Review), a forward-looking assessment of how artificial intelligence (AI) could reshape retail financial services by 2030 and beyond. The Review has been part of the FCA’s response to growing policy interest and parliamentary scrutiny of the role of AI in the UK financial services sector. For instance, the House of Commons Treasury Committee published a report on 22 January 2026 on the associated risks and benefits of AI. It recognised that the financial services sector has substantially outpaced other sectors in AI adoption, with approximately 75% of UK financial services firms using AI in its operations.
The Review is significant because it considers a market in which increasingly autonomous and agentic AI systems may play a central role in customer journeys, firm operations, competition, fraud prevention and regulatory supervision in the future.
The FCA confirms that it does not currently plan to introduce AI-specific regulations. Instead, it intends to rely on existing principles-based and outcomes-focused frameworks, while recognising that supervision, interpretation and regulatory expectations will need to evolve as AI becomes more autonomous. Authorised firms should note that the absence of new AI-specific rules should not be interpreted as regulatory inaction or a lower compliance burden. Instead, they follow from the FCA’s principles-based/outcomes-focused approach.
Projected regulatory implications
The Review does not amend the FCA Handbook. However, it has clear implications for how existing regulatory requirements may be applied and supervised as AI use becomes more embedded across firms and customer journeys.
Senior Managers Regime (SMR): The Review suggests that existing accountability frameworks remain broadly capable of applying to AI deployment, provided that responsibility for outcomes remains identifiable. In practice, senior managers may need to evidence reasonable steps through stronger governance, clearer allocation of responsibility, effective monitoring and meaningful assurance over AI-enabled processes.
Operational resilience: AI-enabled critical business services may place additional strain on firms’ resilience frameworks, particularly where firms rely on common models, technology providers or data infrastructure. The Review points towards greater system-wide coordination, contingency planning and oversight of third-party dependencies rather than a new AI-specific resilience regime.
Regulatory perimeter: The Review recognises that increasingly autonomous AI systems may blur the boundaries of the current regulatory perimeter, especially where AI providers, platforms or agents influence financial decision-making without themselves being authorised firms. The FCA is likely to consider whether the perimeter remains effective in preserving accountability and consumer protection.
Consumer Duty: The Consumer Duty remains a central framework for AI-enabled retail financial services. However, firms may find it more difficult to evidence good outcomes, consumer understanding and fair treatment where AI is constantly involved. The practical challenge will be evidencing outcomes in a way that is sufficiently granular and auditable.
Infrastructure for agentic finance: The Review describes agentic finance as a future in which AI agents or bots act by delegation, or with increasing autonomy, to carry out financial tasks. Safe adoption will require infrastructure that supports consent, authentication, liability allocation, auditability and accountable delegation.
Nature of supervision: One of the Review’s most important themes is that the FCA itself will need to change. The Review envisages more AI-enabled, data-led and potentially agentic supervision, enabling the regulator to monitor risks, outcomes and dependencies more dynamically and at greater scale. This aligns with the FCA’s strategy for 2025 to 2030 to become a smarter regulator, such as by using predictive AI and large language models to improve efficiency in authorisations and supervision.
International cooperation: AI deployment is inherently cross-border. The Review therefore emphasises international cooperation, particularly in relation to shared technology dependencies, financial crime, cyber risk, data flows and common regulatory standards.
Future form of supervision
A key takeaway is that the future regulatory response may be expressed more through supervision and interpretive development than through immediate legislative change. The current framework regulatory framework would continue to operate effectively where AI merely supports human judgement. They may begin to struggle where humans move from operators to approvers or observers, and where AI systems make repeated decisions over time.
Wider context of the Review
The Review is focused on retail financial services and does not directly address wholesale or institutional markets. However, its themes are unlikely to remain confined to the retail sector. Issues such as model governance, accountability, third-party dependency, operational resilience, explainability and regulatory perimeter questions are equally relevant to other parts of financial services where AI is deployed at scale.
The Review also sits alongside the FCA’s wider AI strategy, including its AI Lab, AI Live Testing and Supercharged Sandbox. These initiatives indicate that the FCA is not taking a passive approach. Rather, it is building technical capability and engaging directly with firms and technology providers to understand how AI systems can be tested, governed and supervised in practice.
The Birketts’ view
The Review is a clear message for firms not to wait for an AI-specific rulebook from the regulator. The FCA’s direction of travel is towards applying existing obligations more intensively to AI use cases, with a stronger focus on governance, accountability, model oversight, outcomes evidence and operational resilience.
Authorised firms should treat the Review as a timely opportunity to assess how AI is being used across their business, identify where AI usage is increasing and test whether existing governance frameworks are robust. Firms should be able to demonstrate that AI-enabled processes deliver fair customer outcomes in a way that will withstand regulatory scrutiny. Firms should also pay close attention to third-party AI dependencies and the controls needed to keep human judgement meaningful as AI systems become more embedded in decision-making and customer-facing activities.
Key Contacts
Audio versions of this article are autogenerated and occasional errors in interpretation may be made. The content of this article is for general information only. It is not, and should not be taken as, legal advice. If you require any further information in relation to this article, please contact the author in the first instance. Law covered as at October 2026.