When a regulator commissions a review of autonomous AI in consumer finance and its headline finding is that the existing framework is sound, the narrative writes itself. The Financial Conduct Authority published the Mills Review on 6 July, the first strategic review of AI in retail financial services initiated by any regulator globally, led by Executive Director Sheldon Mills, and the summary that circulated was reassuring: Consumer Duty holds, the Senior Managers Regime holds, no emergency rulemaking needed.
That reading is accurate. It is also incomplete. Recommendation six of seven tells a different story: the FCA should build and adopt an AI-enabled agentic supervisory model. The regulator’s answer to firms deploying AI that acts without waiting to be asked is to build AI that supervises without waiting to be asked.
What the review actually describes
The Mills Review’s starting point is a system already substantially transformed. Twenty-eight million UK adults now use AI to manage their money. More than three quarters of regulated firms have integrated AI into their operations. The review’s task was not to assess the present but to map what a further decade of autonomous, adaptive, interconnected systems means for consumers, for competition, and for the regulator tasked with watching both.
The picture of consumer appetite is arresting. Research commissioned for the review by Yonder Consulting, a survey of more than 5,000 UK adults in April 2026, found that roughly one in five people (around 11 million) are likely to use AI that can act autonomously within pre-set goals. They want the system to execute, not consult. The same survey found 68 per cent worried about data misuse and 67 per cent concerned that existing protections would not apply to AI-mediated decisions. Consumers are reaching for autonomy while simultaneously mistrusting the systems they would hand decisions to, and they are doing so ahead of the accountability infrastructure the review itself recommends building.
Where the existing framework holds, and where it does not
The review is precise about the limits of its own reassurance. Consumer Duty and the Senior Managers Regime “operate effectively while humans act as operators, collaborators and consultants,” it concludes. Both were built for a world in which a named human reviews a significant decision before it is taken, and where consumer outcomes can be traced back through a chain of identifiable actions.
Pressure emerges, the review notes, at the approver and observer stages: the modes in which humans set parameters and monitor aggregates rather than reviewing individual acts. At those levels, “meaningful human control becomes difficult to evidence.” An AI agent that authorises a mortgage application, routes a complaint, or triggers a trading instruction without a human reviewing the specific event is not clearly captured by a framework that requires an accountable individual to be able to explain what happened and why.
The review does not describe this as a failure. It describes it as a design boundary: frameworks shaped for one kind of principal being stretched toward a different kind. Consumer Duty requires firms to demonstrate good outcomes; the Senior Managers Regime requires a named human to be accountable for decisions. Both assume that humans can know, after the fact, what occurred. Agentic systems interacting with each other make that increasingly difficult to reconstruct.
The inversion at the centre of recommendation six
The FCA’s answer is not new prescriptive rules. Mills has been consistent on that point: outcomes-based regulation is adaptable; rules-based regulation would be obsolete before the consultation closed. The bet is that existing frameworks are sufficiently flexible to be stretched into the agentic era, with accountability gaps addressed through supervisory evolution rather than fresh legislation.
What that evolution looks like is recommendation six. The FCA would deploy AI across authorisation, supervision and enforcement, monitor firm outcomes in near real time, and eventually run agent-to-agent workflows in which supervisory systems triage submissions, test evidence against expectations, and generate information requests. Reporting would shift from periodic returns toward continuous, event-driven flows. The review specifies that the FCA should develop its own AI to the consultant and approver levels only, with human supervisors retaining responsibility for judgement and intervention, but the direction of travel is explicit: a regulator built to match pace with the autonomous firms it oversees.
The other six recommendations sit around this core. The FCA should secure and adapt its regulatory perimeter as AI reshapes the boundary of financial advice. It should strengthen coordination with the Bank of England, the CMA, and international counterparts, given the systemic risks that arise from interconnected models and concentrated hyperscaler dependencies. It should monitor the transition to autonomous models and adapt frameworks as that transition accelerates. It should scale up its AI Lab to support innovation. It should enable the foundational infrastructure (data standards, liability frameworks, authentication) that would allow consumer-facing AI agents to operate safely. And it should build a free, public-interest AI-enabled financial capability service for consumers who lack access to the advice their wealthier counterparts can afford.
The structural bet
The Mills Review is a document about a transition that has already started and is not going to be interrupted by a regulator asking it to pause. Its honesty lies in the acknowledgement that the FCA cannot supervise at the speed of autonomous finance using the tools it has. The proposal is to build the missing tools rather than slow the technology.
The consumer data underlines why that urgency is real. One in five adults is already prepared to hand consequential financial decisions to a system that acts without asking, and they are doing so before the accountability frameworks the review recommends have been adapted for that mode of operation. The gap between consumer willingness and regulatory infrastructure is not a warning about what might happen. It is a description of what is happening.
The review’s wager is that the FCA can close that gap by deploying its own agentic capability fast enough to watch what the sector is building. The alternative (a regulator that continues to supervise periodic returns while the firms it oversees run continuous autonomous processes) is not described as catastrophic. It is described, with characteristic regulatory understatement, as a regulator that will need to choose what it covers and what it leaves uncovered.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.