FCA’s Mills Review: Agentic AI, Consumer Duty and the future of financial services
The Financial Conduct Authority (FCA) has this week published the findings of The Mills Review (“the Review”),1 a landmark assessment of how artificial intelligence (AI) could transform UK retail financial services by 2030 and beyond. The report, led by FCA Executive Director Sheldon Mills and commissioned by the FCA Board, is the first review of its kind undertaken by a financial regulator globally.
While headlines have focused on AI's opportunities and risks, the Review's most significant message is arguably more fundamental: the FCA believes financial services are moving towards a world where consumers increasingly delegate financial decisions and actions to autonomous AI systems.
For firms, this means AI should no longer be viewed solely as a technology initiative, but as a governance, conduct, operational resilience and regulatory issue.
In this article, we summarise the key findings from the Review, what this means for regulation and the steps firms adopting AI should be taking now.
The FCA's central finding: the rise of "agentic" finance
The Review concludes that advances in AI capability are likely to be a defining force in retail financial services over the next decade. AI is expected to transform how firms operate, how products are distributed, how consumers make financial decisions and how regulators supervise markets.
A key theme running throughout the report is the emergence of ‘agentic AI’ – systems capable of acting autonomously within parameters set by a user.
Today, many consumers use AI to obtain information or compare options. The FCA envisages a future where consumers increasingly delegate tasks to AI agents capable of monitoring finances, comparing products, switching providers, arranging insurance, making investment decisions and executing payments on their behalf.
The FCA's consumer research suggests this future may arrive sooner than many expect. According to customer research commissioned by the FCA, the Review found that approximately 20% of UK consumers, equivalent to around 11 million adults, are likely to use AI capable of acting autonomously within pre-set goals.
Whilst consumers appear open to these developments, concerns around trust, transparency and control remain significant.
Get in touch
Four major AI-driven shifts identified by the FCA
The Review identifies four structural changes likely to reshape retail financial services by 2030.
The FCA expects firms to move beyond using AI as a productivity tool towards increasingly autonomous operating models. AI is likely to become embedded across customer service, underwriting, product development, compliance, fraud detection, claims handling and operational functions.
The potential benefits include enhanced efficiency, reduced costs and improved customer experiences. However, this also raises important questions around governance, accountability and oversight.
The Review anticipates a significant shift from human-led financial decision-making towards AI-assisted and AI-enabled consumer journeys. The FCA describes a spectrum ranging from AI acting as a simple tool through to situations where consumers largely monitor outcomes whilst AI systems make and execute decisions within agreed boundaries. This has the potential to improve personalisation, reduce inertia and address long-standing challenges such as under-saving, under-investment and poor product engagement.
More fundamentally, the Review suggests AI could help tackle some of the information asymmetries and behavioural frictions that have historically prevented consumers from making optimal financial decisions. By helping consumers better understand products, compare options and take timely action, AI has the potential to support better financial outcomes at scale.
In many respects, this appears to be one of the FCA's central themes throughout the Review: that technology should ultimately enable consumers to make healthier financial decisions. The regulatory challenge will be ensuring that innovation delivers those benefits without creating new risks around consumer understanding, financial capability, over-reliance on automated decision-making and accountability.
The Review also highlights the potential for AI to democratise access to financial services by making personalised guidance, analysis and decision-support tools available to consumers who may previously have lacked access to professional financial advice or wealth management services.
One of the Review’s more interesting observations concerns competition. Historically, financial services firms have competed for direct consumer relationships. In an increasingly agentic environment, AI systems may sit between consumers and firms, comparing products and making recommendations based on price, risk, value and suitability.
The FCA notes that competitive advantage may increasingly accrue to organisations that control customer interfaces, data and digital ecosystems. This could include major technology providers, AI firms and digital platforms as well as established financial institutions. For firms, this raises strategic questions around distribution, customer acquisition and the future role of brand loyalty when AI agents become key decision-makers.
The Review highlights AI-enabled fraud as one of the most significant risks facing the sector. The FCA expects advances in AI to increase the sophistication of fraud, identity theft, impersonation attacks, deepfakes and other forms of financial crime.
At the same time, AI will also enhance firms' defensive capabilities in areas such as fraud monitoring and cyber security. The challenge for firms will be ensuring that innovation improves resilience rather than creating new vulnerabilities.
What does this mean for regulation?
The Review does not currently recommend the introduction of a standalone AI regulatory regime for retail financial services. Instead, the Review reinforces the regulator's existing principles-based approach, relying on established regulatory frameworks including:
the Consumer Duty
the Senior Managers and Certification Regime (SMCR)
Operational Resilience requirements; and
the emerging Critical Third Parties regime
However, firms should not interpret this as a light-touch approach.
The FCA recognises that AI may significantly increase the scale, speed and complexity of issues such as transparency, discrimination, pricing, consumer understanding, outsourcing and accountability. The focus is therefore likely to remain firmly on outcomes rather than the technology itself.
The Review does, however, raise important questions about the future regulatory perimeter. As consumers increasingly rely on AI models and agents to help make financial decisions, the FCA is considering whether certain AI-enabled services may begin to resemble regulated advice, guidance or distribution activities. This is likely to be an important area of regulatory debate as agentic finance develops.
AI is becoming an operational resilience and outsourcing issue
A notable feature of the Review is the emphasis placed on technology supply chains. The FCA highlights increasing reliance on AI providers, cloud service providers and hyperscalers, together with the growing complexity of accountability between firms, senior managers, technology suppliers and model developers. This suggests firms should increasingly view AI through an operational resilience lens, alongside traditional conduct and governance considerations.
The FCA intends to become an AI-enabled regulator
The Review is not solely about how firms use AI. It also reflects the FCA's broader ambition to become a more data-led and technology-enabled regulator. The Review recommends the development of an AI-enabled supervisory model supported by greater use of data, technology, testing environments and specialist technical expertise. It also calls for the continued expansion of initiatives such as the FCA's AI Lab.
Rather than representing a fundamental change in direction, these recommendations build on the FCA's already well-publicised strategy of using data and technology more effectively to identify harm, target supervisory interventions and improve regulatory outcomes. The Review suggests that AI will become an increasingly important tool in delivering that objective.
For firms, the practical implication is that supervisory engagement may become increasingly data-driven, proactive and technology-enabled. Over time, firms may find themselves dealing with a regulator that is able to analyse larger volumes of information, identify emerging risks more quickly and focus supervisory resources more precisely on areas of potential consumer harm or market weakness.
Seven recommendations for the FCA
The Review recommends that the FCA:
Secure and adapt the regulatory perimeter
Strengthen system-wide coordination and oversight
Monitor the transition to autonomous models and adapt regulatory frameworks
Scale up the FCA's AI Lab
Enable the foundations for agentic finance
Build and adopt an AI-enabled supervisory model
Develop a trusted public-interest AI-enabled financial capability service
What does the Mills Review mean for firms now?
Although much of the Review looks ahead to 2030 and beyond, its implications for firms are more immediate.
The FCA is signalling that AI adoption should no longer be viewed solely as an innovation initiative. As firms move from using AI as an assistive tool towards increasingly autonomous and agentic systems, boards and senior management will need to ensure that accountability, oversight and customer outcomes remain appropriately governed.
The Review reinforces that firms should not expect a standalone AI rulebook in the near term. Instead, the FCA is likely to continue assessing AI-enabled activities through existing frameworks such as Consumer Duty, SMCR, Operational Resilience and outsourcing requirements. The regulatory focus is therefore likely to remain on outcomes, accountability and effective oversight rather than the technology itself.
However, firms should also recognise that the Review is not solely focused on risk management. The FCA clearly sees AI as a significant opportunity to improve consumer outcomes, reduce friction in financial decision-making and help address persistent issues such as disengagement, poor financial literacy and low levels of saving and investment. Firms that can demonstrate how AI supports better customer outcomes, alongside appropriate governance and controls, are likely to be better aligned with the direction of travel set out in the Review.
In that respect, the Review suggests that innovation and consumer protection should not be viewed as competing objectives. Rather, the FCA sees AI as a potential means of delivering better consumer outcomes, provided firms can demonstrate appropriate governance, accountability and oversight.
As AI systems become more autonomous and firms increasingly rely on interconnected internal and third-party models, demonstrating accountability may also become more complex. Firms may find it harder to evidence how decisions were reached, identify the source of errors or bias, and demonstrate reasonable steps under existing regulatory frameworks. The Review therefore suggests that governance, oversight and assurance frameworks will need to evolve alongside advances in AI capability.
What should firms be doing now?
While the Review does not introduce new regulatory obligations, it provides a strong indication of where firms should be focusing their efforts.
Review AI governance and accountability frameworks - Boards should ensure they have appropriate visibility of AI use cases across the business, clear governance arrangements and appropriate SMCR accountability
Review model risk management and assurance frameworks – As AI becomes more embedded within business operations, firms should consider whether existing model risk management, validation and assurance frameworks remain appropriate for increasingly complex and dynamic AI systems. The Review highlights challenges such as opacity, model drift, bias, hallucinations and emergent behaviours that may require more continuous approaches to governance and oversight
Assess Consumer Duty implications – Firms should consider how AI impacts customer understanding, fair value, foreseeable harm and vulnerable customers, particularly where AI is influencing or making decisions on behalf of customers
Prepare for increasingly autonomous systems – The Review focuses not just on generative AI but on agentic AI capable of autonomously taking actions. Firms should consider how existing control frameworks would operate where AI systems are authorised to initiate transactions, make recommendations or execute decisions with limited human intervention
Strengthen third-party risk management – Firms should review outsourcing, operational resilience and supplier oversight arrangements as dependence on AI providers, cloud providers and hyperscalers increases
Review fraud and cyber controls – Firms should ensure fraud prevention, financial crime and cyber resilience frameworks are capable of responding to increasingly sophisticated AI-enabled threats
Monitor regulatory developments – The FCA has confirmed that it intends to publish guidance on AI good and poor practice later this year alongside continued expansion of initiatives such as AI Lab and AI Live Testing
Ultimately, the firms best placed to navigate the next phase of AI adoption will be those that treat AI not simply as a technology initiative, but as a strategic governance and regulatory issue requiring board-level attention.
Get in touch
If you would like to discuss the implications of the Mills Review, AI governance, Consumer Duty, SMCR accountability or the deployment of AI and agentic systems within regulated businesses, please contact Sushil Kuner or a member of our Financial Services Regulation team.
1 The Mills Review: AI and the future of retail financial services
The content of this page is a summary of the law in force at the date of publication and is not exhaustive, nor does it contain definitive advice. Specialist legal advice should be sought in relation to any queries that may arise.
Related expertise
Contact us today
Whatever your legal needs, our wide ranging expertise is here to support you and your business, so let’s start your legal journey today and get you in touch with the right lawyer to get you started.
Get in touch
For general enquiries, please complete this form and we will direct your message to the most appropriate person.