FCA Seeks Tougher AI Rules as Agents Rise

For practitioners building production ML systems in finance, the Mills Review shifts the compliance bar from model-performance metrics alone toward capabilities around observability, explainability, and autonomous-action governance. Industry teams that embed agentic features should expect regulator attention to deployment controls, consent boundaries, and system-level monitoring as key operational requirements rather than optional best practices.

What happened - Reported facts: Per the Mills Review published by the FCA, the paper examines how AI could reshape retail financial services by 2030 and identifies four major shifts: firm operations, consumer journeys, competition and market power, and amplified fraud and cyber risks (Mills Review / MondoVisione). The review reports that a fifth of people, equivalent to 11 million UK adults, are likely to use AI that can act autonomously within pre-set goals (MondoVisione; FCA review). The review sets out seven recommendations for the FCA Board and Executive, including securing the regulatory perimeter, strengthening system-wide coordination, monitoring autonomous models, scaling the FCA's AI Lab, enabling foundations for agentic finance, building an AI-enabled supervisory model, and developing a public-interest AI-enabled financial capability service (Mills Review / MondoVisione). Executive director Sheldon Mills is quoted saying "Artificial intelligence will transform financial services by 2030," and reporting in the Financial Times records Mills calling regulatory adoption of AI an "arms race" as regulators seek to keep pace with the technology (MondoVisione; FT).

Agentic or "autonomous-action" systems change the unit of regulatory concern from isolated model outputs to end-to-end decision loops that include policy logic, human-in-the-loop thresholds, and automated execution of financial actions. Industry experience shows that architecting for safe agentic behaviour typically requires:

• •robust action governance (consent, scope, rollback),
• •continuous monitoring for distribution shift and emergent behaviours, and
• •richer provenance and explainability metadata tied to each action.

These are technical capabilities that go beyond classical ML metrics and are the kinds of artefacts regulators are now asking to see in supervision scenarios.

Reporting across the Guardian, Financial Times and industry outlets frames the Mills Review as one of the first comprehensive regulator-led roadmaps that explicitly contemplates agentic finance and supervisory automation (Guardian; FT; MondoVisione). For compliance and platform teams, that means regulators may prioritise oversight primitives (audit trails, access controls, consent management) and systemic monitoring at the institution level rather than limiting scrutiny to model training datasets or a single-risk score.

What to watch - Observers and practitioners should follow three indicators: regulatory moves to clarify the perimeter for third-party models (including large language models), published supervisory standards or data-access arrangements for regulator-led model testing, and pilot programs where regulators use AI to augment surveillance. Reporting also highlights consumer concerns about trust and control in agentic systems, which will likely shape required disclosure and opt-in controls (MondoVisione; Guardian).

Data scientists and ML engineers should prioritise building instrumentation that maps agent actions to user authorisations and outcomes, so logs support both post-hoc audits and automated alerting. Risk and product teams will need to formalise acceptance criteria for allowable autonomous actions and ensure consumers retain clear opt-out and oversight mechanisms. These observations are framed as industry patterns rather than claims about any firm's internal roadmap.

Reported-source notes: The summary synthesises reporting from the Mills Review published by the FCA, MondoVisione coverage of the review, reporting in the Financial Times, and coverage in the Guardian and PYMNTS (FCA review / MondoVisione; FT; Guardian; PYMNTS).