FCA Mills Review: early indications for AI development in financial services
The shift from generative assistants to autonomous agentic AI is officially on the FCA’s radar.
Launched on 27 January 2026, the Mills Review asks for engagement on how UK financial services will be regulated through to 2030. If you are developing in this space, the Mills Review, along with the FCA AI Approach and Update on AI, provide useful indications of how to integrate regulation into the development phase and avoid costly reverse engineering.
The Mills Review is the future-gazing inquiry (asking questions about AI and financial services for 2030+), while the FCA AI Approach and Update on AI (and the associated AI Lab/Sprint feedback) contains the actual regulatory expectations for today.
Here are some main takeaways and policy theme:
Accountability and the SM&CR
The regulator is focused on closing the accountability gap that emerges when decisions are automated.
- Complexity is not a valid defence for failures, systems must be explainable and safe.
- The Mills Review queries whether existing frameworks like SM&CR and the Critical Third Parties Regime are suitable to manage future AI risks, including chains of accountability between firms and model developers.
- A human in the loop can be an important way to mitigate risks: but developers will need to think about how and where this is put in place to ensure it is effective.
- Responsibility for AI deployment may need to evolve – this could mean, for example, updates to statements of responsibilities for those to include technical governance.
Data Strategy as Architecture
Data strategy will be important – as AI converges with DLT, tokenisation, and the Data Use and Access Act 2025, architectural choices become a competitive limit.
- You must understand how data is structured and what will be needed for the product to function in the future.
- Smart data and Open Finance, along with richer consumer data, will enable hyper-personalisation: flexible architecture can unlock new products and services.
- New architecture will become the platform for your whole business: ensure you retain ownership and control of important assets and trade secrets within your developer contracts.
The Consumer Duty and Vulnerability
The duty is the golden thread running through the review and the FCA AI Update.
- Client outcomes matter more than the technology that delivers them.
- Firms must consider vulnerable customers at the ideation and testing phases, not just at the point of sale.
- Even when an agent mediates an interaction, the firm remains responsible for providing fair value.
Operational Resilience
For advanced builders, the focus is on maintaining control in a volatile market.
- Can the firm suspend an agent without causing disruption to its regulated services?
- Model portability is also relevant to resilience: make careful choices between open and closed capabilities to ensure data portability; avoid being locked into a single platform or developer environment. There will be trade-offs depending on your firm’s strategy.
The window for feedback is narrow, with a deadline for evidence-backed views on the Mills Review by Tuesday 24 February 2026
The FCA is specifically asking 20 questions across four themes - ranging from market concentration to the regulatory perimeter.
If you’re building agentic AI, responding now could prevent a square-peg-round-hole regulatory situation in 2027.
Key Themes to Address:
- The accountability gap: Provide your view on whether the current SM&CR is sufficient for autonomous AI.
- Market Concentration: If you believe Big Tech control of AI models will hurt competition in financial services, the FCA specifically asks for evidence on this.
- Innovation vs. Regulation: Highlight any friction points where current rules prevent you from deploying AI that would actually improve customer outcomes.
You can find the response form and the full review here:
Review into the long -term impact of AI on retail financial services (The Mills Review)
AI and the FCA: our approach | FCA
