FCA's Mills Review puts AI accountability at heart of UK fintech

The UK's Financial Conduct Authority has published the Mills Review, a forward-looking assessment of how artificial intelligence could transform retail financial services through to 2030 and beyond. Drawing on 140 submissions and research involving more than 5,000 UK adults, the Review stops short of legislative force but maps the direction of regulatory travel with unusual clarity. Its publication, within a fortnight of the government appointing Kanishka Narayan as Minister for Artificial Intelligence with a Cabinet-attending role, underlines that AI governance has moved from a specialist policy debate into the centre of economic decision-making.

For financial services firms, the two developments together represent a shift in the regulatory backdrop rather than a single compliance event. Joe Norburn, CEO at TCC Group, which provides regulatory consultancy and compliance solutions under the TCC, Momenta and Recordsure brands, argues that the Review should prompt immediate action on AI governance, accountability and monitoring: "The Review's influence is likely to emerge through FCA guidance, supervisory expectations, changes to the regulatory perimeter and the application of existing rules."

From assistance to delegation

The Mills Review's most consequential observation concerns a shift in how AI is used in customer journeys. Tools that once assisted consumers in comparing savings accounts or identifying vulnerability signals are increasingly capable of recommending actions, preparing decisions and, within preset parameters, initiating activity autonomously. One in five UK adults told the Review they would consider allowing an AI system to act on their behalf within agreed goals. Only 40 per cent, however, correctly understood that they have no formal recourse when acting on advice from a general-purpose AI tool that sits outside the FCA's regulatory perimeter.

That gap between consumer expectation and regulatory reality is where the accountability risk concentrates. When an AI system shapes a customer outcome, whether supplied by the firm itself or a third-party provider, existing obligations under the Consumer Duty, the Senior Managers Regime and operational resilience rules still apply. The firm remains liable even where the underlying model's behaviour evolves as data, market conditions or customer patterns change. Boards that cannot demonstrate clear ownership of which systems influence decisions, and who carries responsibility when those systems err, face mounting exposure.

The convergence angle: AI governance as a cross-sector infrastructure question

The Mills Review is framed as a financial services document, but the governance challenge it describes is not confined to fintech or retail banking. The same accountability gap between AI-initiated action and human oversight is emerging wherever automated systems shape high-stakes decisions at scale, from health insurance underwriting to credit scoring for property transactions to algorithmic procurement in defence supply chains.

What makes the UK regulatory posture notable from a cross-sector perspective is its mechanism: rather than imposing prescriptive rules, the FCA is signalling intent through supervisory expectation and guidance, leaving accountability squarely with the firm. This approach mirrors the trajectory in other jurisdictions, including the EU AI Act's risk-tiered framework and early signals from US federal regulators on model risk management. Boards across industries that deploy AI at customer-facing or decision-making scale would be prudent to treat the Mills Review as a preview of the governance environment they will face by 2028, regardless of sector.

The capital implication is also worth noting. Regulatory compliance infrastructure, including model monitoring, decision logging, escalation frameworks and third-party oversight tooling, is becoming a growth market in its own right. Consultancies, regtech platforms and audit-adjacent software vendors are increasingly positioned to capture spending that firms will have to commit as AI becomes embedded in regulated processes. For investors tracking the compliance-technology space, the Mills Review represents a demand-creation signal.

The FCA has indicated it will examine, within three to six months, how consumers use general-purpose AI tools across savings, investments, pensions, mortgages and debt management. That review could lead to amended guidance or formal recommendations to government about the regulatory perimeter. For firms still mapping their AI footprint at board level, the window to act ahead of that next stage is narrow.