FCA publishes landmark Mills Review into AI and retail financial services: what firms need to know

By 2030, AI will take on a greater share of the work in financial services. The Review sets out an "autonomy spectrum" along which humans progressively move from performing tasks themselves towards setting boundaries, granting permissions and overseeing outcomes produced by AI agents. The spectrum runs through five roles, in summary:

• operator (AI as tool);
• collaborator (human and AI plan and act together);
• consultant (AI compares options and recommends, human gives guidance);
• approver (AI prepares, human authorises); and
• observer (AI acts continuously within agreed limits, human monitors).

The further a system sits along the spectrum, the more the human role shifts from carrying out individual tasks to setting the conditions within which AI systems operate, and accountability becomes harder to trace, especially where models change over time and firms depend more heavily on model providers and external AI agents. This framework is the lens through which the Review assesses both regulatory adequacy and firm-level risk, and as such is worth becoming familiar with.

By 2030, many firms could have moved significantly further along the autonomy spectrum, embedding AI into almost every function from customer support and underwriting to compliance, claims and product design. For leading firms, AI may become the primary method by which they process information, serve customers and evidence outcomes. AI places pressure on governance frameworks because models update continuously rather than on fixed release cycles, they draw on third-party inputs that a regulated firm did not create or build, and they are probabilistic in nature, meaning that managing AI requires extending governance or model risk management frameworks beyond validation at the point of deployment towards live monitoring, tracking drift, model degradation and outliers. Firms that can demonstrate auditability, explainability where needed, robust testing, clear permissions, effective monitoring and escalation will be able to deploy AI more confidently, and acquiring a reputation for trusted AI processes could itself win business.

Demand for automated financial decisions is already emerging: 1 in 5 consumers are open to AI making decisions for them, suggesting the shift to agent-led journeys is a credible near-term development. However, multiple concerns are currently holding back wider adoption:

• 68% of consumers expressed concern about data misuse;
• 67% about lack of protection;
• 65% about the concentration of power among a small number of large organisations; and
• 45% saw no benefit of AI in financial services at all.  

The Review notes that those saying there was no benefit were generally older and on lower incomes, meaning access to “good AI” may become a new divide: if the best services are paid for, difficult to use or poorly designed, some consumers who could benefit most may be least able to access them.  Firms must design inclusively and cannot assume an AI-first, one-size-fits-all approach will satisfy their Consumer Duty obligations.

Control of and access to AI-mediated consumer interfaces will become a major source of market power and will reshape competitive dynamics. AI may shift the nature of intermediation towards integrating with agents, platforms and data-access layers, while firm-level AI capability will become a core competitive advantage. AI may lower barriers to entry for newer and smaller firms, whilst scale advantages in data, trust and vendor access may favour incumbents. This creates competitive tension between regulated firms and out-of-perimeter AI platforms. A general-purpose AI service may shape consumer understanding, narrow options or recommend courses of action without being part of the traditional financial services relationship, creating an uneven playing field if regulated firms face obligations around communications, advice, promotions and consumer outcomes whilst AI platforms exert similar influence through a different route. Firms need to consider actively how their products and services are presented to, and selected by, AI systems acting on behalf of consumers.

AI will amplify fraud and cyber risks by 2030: they will become faster, cheaper, more scalable and more persuasive. The main pressure is speed and scale, faster exploitation of existing weaknesses, whether in customer-facing processes or cyber controls, and risks will cut across the system, spanning firms, platforms, telecoms, payment rails, identity systems, AI or technology providers and multiple jurisdictions. AI is lowering the barriers to fraud: techniques such as cloned voices, synthetic identities and highly realistic fake content are making scams easier to produce, cheaper to scale and harder to spot, enabling a much wider pool of criminals to carry out convincing fraud, especially when combined with compromised personal data across onboarding, payments, telecoms and digital platforms. Firms should be able to show that AI-enabled controls improve detection, triage or disruption, remain effective as threats evolve, and retain meaningful human control where decisions affect fairness, accountability or customer harm.

The overall regulatory framework remains sound. Its principles and outcomes-based approach, including the Consumer Duty, the Senior Managers Regime (SMR), operational resilience and other key features, was designed to flex across changing business models. However, the Review finds that whilst the SMR would be robust to the challenges of AI operating in Operator, Collaborator and Consultant modes, the increasing opacity inherent in more delegated and autonomous AI operation at the Approver or Observer stage, coupled with factors such as model drift, could create an emerging pressure point in accountability: a potential gap between the outcomes of AI-mediated decisions and the ability of the regulator to identify a de facto responsible party. Stakeholders highlighted that firms need clearer interpretation of how to evidence outcomes in dynamic journeys and how to ensure consent remains meaningful where systems act continuously, particularly at higher levels of autonomy.

The Review sets out seven priority recommendations designed to work together as a system to adapt the regulatory framework, enable effective supervision and support better consumer outcomes. They are:

• secure and adapt the regulatory perimeter;
• strengthen system-wide coordination and oversight;
• monitor the transition to autonomous models and adapt regulatory frameworks;
• scale up the FCA's AI Lab to support AI model and system innovation;
• enable the foundations for agentic finance;
• build and adopt an AI-enabled agentic supervisory model; and
• develop a trusted public-interest AI-enabled financial capability service.

Running in parallel, the FCA will launch an AI good and poor practice publication later in 2026, drawing on direct engagement with firms to find out what is working well, where firms are facing challenges, and where further clarity would help.