Mills review
On Tuesday, January 27, 2026, the FCA launched the Mills Review. The subject of the review is how advances in artificial intelligence or AI could “transform” retail financial services. The review is being spearheaded by Sheldon Mills and will result in a report to the FCA Board in the summer, with recommendations. The results of the review will also be published.
Key messages
- The FCA continues to hold the view that it will not introduce extra regulations on AI. Instead, it will rely on existing regulatory rules, “which are principles-based and focused on outcomes and mitigate many of the risks associated with AI”.
- The FCA sees AI as a major opportunity to improve outcomes for customers, as well as enhance the UK’s global standing, attract inward investment, and support growth and competitiveness.
- The FCA sees its role as twofold: first, supporting firms in realising these opportunities, and secondly, supporting UK firms to “responsibly adopt” AI.
But with opportunities come risks:
- Sophisticated AI-enabled fraud and identity abuse, algorithmic bias, discrimination, opaque decision-making, misleading or hallucinatory advice, and erosion of consumer trust. AI could potentially reduce consumer agency and introduce new forms of market concentration or systemic vulnerability.
- AI significantly expands the potential for cyber-enabled threats, such as model manipulation, and fraud and financial crime risks, such as deepfake technologies and synthetic identities to exploit onboarding or decision-making processes.
- Increasingly autonomous and interconnected AI systems may amplify existing risks and create new ones.
- AI could cause market power to shift from financial services firms towards AI firms who control consumer interfaces, own consumer data and design AI agents. This could move value chains beyond the FCA regulatory perimeter and also impact competition.
- AI gives rise to questions of operational resilience, outsourcing, and a reliance on third parties, as well as questions about accountability between firms, senior managers, technology providers and model developers.
- The FCA considers we may be at an inflection point in terms of how AI interacts with financial services, making the timing of the review key.
Key data
The FCA reports (based on a study by Lloyds Banking Group) that millions of consumers now use AI to “navigate their financial lives”.
It considers that more than 75% of UK financial services firms are now using AI in some form.
In terms of consumer take-up: it considers this is at an early stage and mostly involves the use of AI as an assistive tool, for example to explain concepts and options.
Themes
The FCA’s engagement paper explores four themes.
Theme one: Future evolution of AI technology
How AI could evolve in the future, including the development of more powerful, autonomous and agentic systems, assessing the whole AI value chain.
- To its credit, the FCA is engaging in open-ended thinking to consider how AI (and the broader ecosystem that develops to facilitate and use it) may evolve, so as to be able to take this into account in considering risks and its regulatory response.
- The FCA is keen to hear from industry as to which emerging or maturing AI technologies are expected to most transform UK retail financial services from 2030 onwards. Plus, the implications for retail finance over the coming decade, including accountability, assurance and market structure.
- A key point underlying the FCA’s comments in this section is that the AI landscape may move from isolated actions to an integrated ecosystem, which raises questions of systematic risk.
- The FCA is also focused on supply chains (data, platforms, infrastructure). This gives rise to familiar issues, albeit AI provides a slightly new context: (a) UK regulated firms (individually and collectively) being exposed to risk by a dependence on firms not subject to UK regulation; (b) complications arising from the question as to “who is responsible for what” within a supply chain; (c) a concern that value may concentrate among a small group of dominant platforms with asymmetric control over data, algorithms, and distribution.
- “As these technologies intersect with complementary developments such as distributed ledger technologies (DLTs), blockchain based ecosystems, smart contract enabled automation, tokenisation, digital identity, and the broader shift toward Open Finance and decentralised finance (DeFi), we expect to see new opportunities alongside emerging threats.”
Theme two: Future impact of AI on markets and firm
How these developments could affect markets and firms, including changes to competition and market structure and UK competitiveness.
- The FCA wants to explore how AI may affect market concentration, barriers to entry and competition generally. It is also interested in who might control primary customer relationships by 2030 onwards—incumbent banks/financial services firms, Big Tech, specialist AI intermediaries, or consumers’ own AI agents.
- Taking an evidence-based approach, it wants to consider how market forces are operating, how they might reshape market structures and customer relationships, and whether value could migrate outside the regulatory perimeter.
- “Across all these sectors we see common underlying forces at work: potential data feedback loops that could entrench market leaders; economies of scale in AI that could raise barriers to entry; network effects that could create ‘winner takes most’ dynamics; and shifting switching costs that could either intensify or dampen competition.”
Theme three: Future consumer trends
The impact on consumers, including how AI could improve outcomes, create new risks, change behaviours, and alter demand and provision of financial services.
- The FCA wishes to explore how customers might benefit, versus what the greatest risk for them will be, from an AI-enabled retail financial services sector. It wishes to consider which segments might “win” or “lose” in the new world, and what specific changes AI will drive, e.g., price, value, fraud, security, etc.
- It is keen to explore different attitudes and behaviour by digital confidence (high/low), financial resilience (stretched/comfortable), scam exposure (recent/none), and delegation style (prefers automation vs control).
- Specific risks—reliance on unregulated AI for guidance or advice, vulnerability to mis-selling, risks created by model bias or hallucination, new forms of AI-driven fraud, manipulation and laundering, exploiting synthetic identities, deepfake interactions, automated criminal ecosystems.
- This section of the FCA’s engagement paper suggests it sees a world where consumers increasingly “delegate” to AI, e.g., managing day to day money flows and making investment choices in real time. We are not sure we see a future in these terms. But we do concur with other scenarios the FCA suggests, e.g., AI tools being used to compare products and get a more personalised experience from firms.
- “We welcome views on what these changes may mean for existing consumer policy, consumer protection and the future of the regulatory perimeter.”
Theme four: Future regulatory approach
How financial regulators may need to evolve to continue ensuring that retail financial markets work well.
- The FCA wishes to consider whether the way it applies its existing frameworks needs to evolve in view of AI. This requires the FCA to consider AI itself, but also to take on board the fact that AI may accelerate the pace of change in the industry generally as well as the speed with which risks may emerge or crystallise. “The FCA will need to ensure its processes and systems can respond at pace. It may need to deploy its own AI agents to act faster, enabled by better data to ensure markets continue to work well.”
- The key frameworks it has in mind: consumer duty, Senior Managers and Certification Regime (SM&CR), operational resilience and the critical third parties (CTP) regime.
- For example, it wishes to consider how senior managers can discharge their responsibilities for the deployment and maintenance of AI systems. It wishes to consider how consumer protection rules and policy may be shaped by AI in the long term, and what pressure they may place on the regulatory regime. New AML and consumer protection challenges may emerge, including autonomous fraud, AI-powered social engineering and identity compromise. “Clear expectations on accountability, auditability and the safe deployment of high-risk AI could be increasingly important.”
- The FCA will consider the approach taken by other organisations and regulatory bodies in the UK and elsewhere. It will also obtain input from AI-focused bodies such as the AI Security Institute and Responsible AI UK.
- It is clear also that the FCA wishes to consider how it can “become a world-leading regulator enhanced itself by AI and new approaches to data”.
Our recommendations
Some firms and trade bodies will have responded to the FCA’s call for input on the questions in its paper.
For most, however, the short timeline (less than a month) will have made this challenging.
At this stage, we would suggest three key takeaways:
- First, the FCA does not propose to introduce new rules for AI use, and at this stage, seems unlikely to do so in the short to medium term. This message is likely to land well with industry.
- Secondly, the FCA continues to be in “watch and learn” mode. Likely, this message will also land well with industry, although some may appreciate more regulatory guidance to ensure they are clear on regulatory expectations, rather than face these being imposed by the regulator later on with “twenty-twenty hindsight”.
- Thirdly, at a practical level, the FCA paper signals areas of risk and potential concern—when conducting internal projects in relation to AI, we recommend firms focus on these specific points to ensure their approach would be considered by the FCA to be robust.