The FCA's Mills Review: what it signals for how AI in financial services will actually be regulated
13 August 2026
The FCA published its Mills Review into AI and the future of retail financial services in early July, the result of a long-term look at how AI, including more autonomous, agentic systems, could reshape financial markets over the coming years. It's worth a closer look, not because it changes your obligations today, but because of what it signals about where scrutiny is heading.
What the review actually looked at
Led by FCA executive director Sheldon Mills, the review examined four things: how AI itself is likely to evolve, how that could reshape markets and competition, what it means for consumers, and how financial regulators may need to adapt to keep markets working well. It's a genuinely forward-looking piece of work, thinking toward 2030 and beyond rather than just today's chatbots.
Why "existing rules apply" is doing a lot of work
The FCA, PRA and Bank of England have all been consistent on one point: they intend to regulate AI through existing frameworks rather than writing bespoke AI rules. That sounds reassuring, familiar territory, nothing new to learn. In practice it means the burden sits with firms to correctly map AI use cases onto rules that were never written with AI in mind, and to be ready to defend that mapping under scrutiny.
The pressure building underneath
Parliament isn't entirely convinced this is enough. The Treasury Committee's January report pushed the regulators to go further: AI-specific stress testing, clearer guidance on consumer protection as it applies to AI by the end of 2026, and explicit clarity on senior manager accountability. The FCA's own March perimeter report flagged a related, separate concern, general-purpose AI tools offering financial guidance that may not fit neatly inside the regulatory perimeter at all.
What this means practically
Expect more specific guidance before the end of the year, not less. Firms that wait for that guidance to arrive before doing anything will be starting from behind. The firms in the best position will be the ones who can already show clear internal ownership of their AI use, human oversight where it matters, and a paper trail, regardless of exactly what the FCA's guidance eventually says.
We'll cover the guidance in detail once it lands. For now, the direction of travel is clear enough to start acting on.
