FCA Mills Review puts AI governance at heart of UK fintech
The UK's Financial Conduct Authority published the Mills Review in July 2026, mapping how artificial intelligence could reshape retail financial services through to 2030. Within a fortnight, the government appointed Kanishka Narayan as Minister for Artificial Intelligence, with a seat attending Cabinet. Taken together, the two moves signal that AI governance in financial services is shifting from voluntary best practice to the centre of UK economic policy.
Joe Norburn, CEO of regulatory consultancy TCC Group, argues that the timing is not coincidental. "The appointment of an AI minister who attends Cabinet reinforces that direction," he writes, "with the government treating AI as an economic and public policy priority." The Review itself drew on 140 submissions and research involving more than 5,000 UK adults, giving it a breadth that earlier, narrower FCA consultations lacked.
From assistance to delegation
The Review's central concern is a shift that is already visible in the market: AI moving from informing decisions to executing them. A retail customer who today uses a general-purpose AI tool to compare mortgage rates could, within a few years, instruct that same system to move funds automatically. A firm using AI to flag customer vulnerability could allow it to determine the appropriate support pathway without human intervention at every step.
That shift changes the accountability calculus sharply. The Consumer Duty, the Senior Managers Regime and operational resilience rules were written around human decision chains. When several models, third-party datasets and cloud providers collectively shape a customer outcome, the firm must still own the result, even as the chain of causation grows longer and less transparent. The Review notes that only 40 per cent of UK adults correctly understand they have no formal recourse when acting on guidance from a general-purpose AI tool sitting outside the FCA's regulatory perimeter, a consumer-protection gap that the regulator is now formally scrutinising.
One concrete output from the Review is a recommendation that the FCA examine, within three to six months, how consumers are using general-purpose AI for savings, investments, pensions, mortgages and debt management. The findings could prompt amended guidance or a formal expansion of the regulatory perimeter, which would directly affect firms whose AI-assisted journeys currently straddle the in-scope and out-of-scope boundary.
The cross-sector governance challenge
For Disrupts readers, the implications extend beyond traditional financial services. The governance architecture the Review calls for, board-level visibility of AI deployment, clear ownership of model performance, real-time monitoring at scale, and documented escalation routes, is structurally identical to what regulators in healthcare, defence procurement and critical infrastructure are beginning to demand of AI-reliant operators.
The competitive dynamic is also worth watching. Firms that build robust AI-governance evidence now gain operational latitude later: they can deploy automated systems more aggressively because they can demonstrate to supervisors that those systems are accurate, fair and auditable. Firms that treat governance as a compliance checkbox are, as Norburn puts it, "storing up a more expensive problem, with controls having to be rebuilt later under greater regulatory pressure." That asymmetry will likely influence capital allocation decisions: investors in AI-driven financial services platforms are already beginning to price governance maturity as a due-diligence variable, alongside model performance metrics.
Sovereign and institutional capital flowing into AI infrastructure should also note the regulatory geography. The Mills Review applies to UK retail financial services, but its framework echoes the EU AI Act's risk-tiering logic and the US Consumer Financial Protection Bureau's recent guidance on algorithmic decision-making. A convergence of regulatory regimes across major capital markets, rather than fragmentation, would lower compliance costs for global platforms, but raise the bar for smaller, domestic-only operators who currently arbitrage lighter-touch environments.
The next inflection point will be the FCA's response to its own three-to-six-month review window. If the regulator moves to expand the perimeter, firms with AI-assisted customer journeys will need governance infrastructure in place, not under construction.