Executive Summary
- What’s new: On 6 July 2026, the FCA published the Mills Review, examining how advances in AI could transform retail financial services by 2030 and making seven recommendations to the FCA Board.
- Why it matters: The Mills Review identifies four systemic shifts by 2030 and concludes the UK’s principles-based framework is a credible foundation for an AI-enabled financial system, but supervision cannot remain firm-by-firm as shared AI dependencies generate ecosystem-level risks.
- What to do next: Firms should consider mapping their autonomy footprint, prioritising oversight and reviewing their contracts with third-party AI applications. Firms that take early action in AI governance are likely better placed to deploy AI confidently and comply with evolving regulatory obligations.
__________
Background
On 6 July 2026, the UK Financial Conduct Authority (FCA) published the Mills Review (Review) to examine how advances in AI could transform retail financial services by 2030. The Review drew on 140 written submissions and a wide range of expertise through meetings, panels and roundtables across financial services. The Review is deliberately forward-looking; rather than assessing AI as deployed today, it considers what a financial services system substantially mediated by AI would demand of firms, consumers and the regulator, and whether the current framework is fit for purpose.
The Review’s focus is overwhelmingly on consumer harm and retail financial services rather than wholesale or institutional markets: Its analysis, evidence base (including a nationally representative consumer survey of over 5,000 UK adults and accompanying consumer focus groups) and recommendations are centred on retail/consumer-facing financial services. The Review does not purport to address wholesale markets or institutional/wholesale conduct issues, and firms whose business is primarily wholesale should not assume direct read-across from its findings.
The Review’s Key Findings
Autonomy Spectrum
The Review envisages an AI-enabled financial system built on foundation models that scale by combining neural networks with rules or formal methods, learning continuously without forgetting, and modelling environments to anticipate the effects of actions. To frame how far AI may displace human judgment, the Review sets out a five-level autonomy spectrum which applies across firm operations:
- Operator: AI assists on request.
- Collaborator: Human and AI plan and act together.
- Consultant: AI leads, human gives guidance.
- Approver: AI prepares, human signs off on key steps.
- Observer: AI executes approved actions, human monitors.
Four Systemic Shifts
In the context of this autonomy spectrum, the Review identifies four systemic shifts that it expects to reshape retail financial services by 2030:
1. The Transformation of Firms
Firms are deploying AI for specific use cases, broadly keeping humans in the loop, but more autonomous applications are being piloted and rolled out. By 2030, firms could have moved significantly further along the autonomy spectrum across a range of functions. This raises challenges, not least the future role of human oversight, and makes AI governance and model risk management a critical capability.
2. New Consumer Journeys
Consumers will increasingly delegate financial decisions to AI acting on their behalf, and demand is already emerging: One in five are open to AI deciding for them, making agent-led journeys a credible prospect. Acting continuously, agentic AI could ease long-standing problems including low switching, the advice gap and weak financial capability. Hyper-personalisation cuts both ways, matching products to needs but enabling bias, opaque pricing and highly personalised manipulation or deceptive design. Uptake will ultimately turn on access, trust and control: Consumers must be able to oversee, understand and challenge AI-driven decisions, and unequal access to good tools risks widening inclusion gaps.
3. A Reshaped Competition Landscape
Competition within the AI supply chain will shape downstream competition between firms and consumer outcomes, and respondents pointed to concentration throughout that chain: few hyperscalers, model providers or chip manufacturers. AI opens additional consumer interfaces, and control of those interfaces will become a major source of market power, reshaping intermediation and disrupting brokers. Firm-level AI capability becomes a core competitive advantage, potentially lowering barriers for smaller entrants while advantages of scale in data, trust and vendor access favor incumbents. Regulated firms also raised level-playing-field concerns, given AI tools offering tailored search and recommendations from outside the perimeter.
4. Amplified Financial Crime and Cyber Risk
Fraud and cyber risk will be faster, cheaper, more scalable and more pervasive by 2030, with speed and scale the main pressure: quicker exploitation of customer deception and weak controls, through impersonation, synthetic identity abuse and automated social engineering. Harm will spread across firms, platforms, telecoms, payment rails and identity systems, beyond any single firm’s visibility. AI is dual-use, strengthening detection but requiring governance, and capability must evolve at system level.
Seven Priority Recommendations
The Review makes seven recommendations to the FCA Board, spanning four interconnected areas: regulatory frameworks and perimeter; supervision and coordination; foundations and capability; and consumer access and outcomes:
1. Secure and adapt the regulatory perimeter. The Review considers the activity-based foundation of the perimeter to remain broadly sound, with pressure points arising mainly where general-purpose AI applications operate outside the perimeter while shaping consumer decisions. Rather than itself recommending that the perimeter be extended now, the Review recommends that the FCA should launch a short-term review, within three to six months, of the impact of general-purpose large language models operating outside the perimeter. This should test how perimeter guidance, the advice/guidance boundary and financial promotions rules apply to conversational journeys.
Based on that review’s findings, the FCA should then decide whether to (a) amend guidance, (b) recommend perimeter changes to government or (c) maintain the current approach; whether any change is made at all, and whether new regulated activities are created, is left open pending that review. Longer-term, rather than proposing an immediate perimeter extension, the Review recommends that the FCA should seek stronger critical third-party and Designated Activities Regime powers, plus direct powers under the Digital Markets, Competition and Consumers Act.
2. Strengthen systemwide coordination and oversight. The FCA should deepen coordination with domestic authorities and international partners across resilience, data, competition, security and consumer protection, including a coordinated incident response framework for AI-related systemic events.
3. Monitor the transition to autonomous models and adapt regulatory frameworks. The FCA should track firms’ progression along the autonomy spectrum and clarify how the Consumer Duty, the Senior Managers Regime and governance expectations apply once decisions are distributed across systems, with firms evidencing outcomes through continuous monitoring rather than point-in-time validation. No respondent argued that the Senior Managers Regime accountability model itself should change, and the Review agrees the regime remains robust and continues to operate effectively where AI operates in Operator, Collaborator and Consultant modes.
The Review does not recommend creating any new Senior Management Functions. However, it flags an emerging pressure point in accountability as AI moves to Approver or Observer modes, where opacity and model drift could make it harder to identify a de facto responsible senior manager or to evidence “meaningful human control” and “reasonable steps.” The Review suggests that clearer FCA guidance on the “reasonable steps” senior managers must take, together with better pre-deployment and ongoing assurance and testing tools to help evidence those steps, could give firms more confidence in adopting delegated or autonomous AI.
4. Scale up the FCA’s AI Lab. The FCA should anchor a structured capability in its existing AI Lab to assess models and systems used in financial services, weighted towards emerging architectures and more capable models in regulated use cases. Earlier engagement with firms, developers and researchers, structured partnerships and published outputs would build independent understanding rather than reliance on providers’ own assessments.
5. Enable the foundations for agentic finance. The FCA should lead a trusted framework for AI agent participation in financial services, covering identity, authority, accountability and execution, with trusted agent standards developed through Open Finance.
6. Build and adopt an AI-enabled agentic supervisory model. The FCA should build its own AI-enabled supervisory tooling, shifting from episodic, document-based supervision towards continuous, systemwide oversight that is risk-based and intelligence-led. This will need to be paired with a more proactive approach to intervention and enforcement.
7. Develop a trusted public-interest AI-enabled financial capability service. The FCA should convene the development of a free, inclusively designed AI-enabled service giving consumers access to reliable financial information, support and guidance.
Navigating the Transforming Regulatory Approach
The FCA Board will consider the recommendations with the Executive and confirm which, if any, it will adopt. In the meantime, there are several immediate priorities for firms to consider:
- Prioritise oversight. Asserting that a person remains in the loop is unlikely to satisfy the Senior Managers Regime. Firms should document what that person is expected to do, when they can intervene and escalation procedures, with particular attention to credit, complaints and compliance decisions. As AI autonomy increases, firms should also ensure Statements of Responsibilities and governance and model risk-management frameworks are kept up to date to reflect senior managers’ AI oversight responsibilities, particularly as AI moves towards Approver or Observer modes.
- Map the autonomy footprint. Firms should audit where current and planned deployments sit on the autonomy spectrum, function by function, and identify where the human role has already moved from operator towards approver.
- Extend model risk management past deployment. Validation at go-live does not detect drift, degradation or emergent behavior. Live monitoring, testing that continues into operation and controls that trigger when systems move outside expected bounds should be the baseline for any model shaping consumer outcomes, including Consumer Duty monitoring, fraud detection, complaints and affordability. The Review notes that the Consumer Duty applies straightforwardly where AI merely supports human decisions (Operator, Collaborator or Consultant modes), but flags increasingly granular pressure points as autonomy rises towards Approver or Observer modes.
On price and value, AI-enabled personalised pricing may make it harder to distinguish legitimate personalisation from value extraction where consumers pay more without receiving additional value. On consumer understanding, dynamic, personalised and continuous AI-mediated journeys make it harder for firms to evidence that consumers genuinely understand products, decisions and risks. On consent, one-off, point-in-time consent may prove insufficient for ongoing autonomous agent activity, since AI may make many micro-decisions over time and harm could occur before consumers become aware. Firms should consider ongoing or continuous consent mechanisms rather than relying solely on point-in-time consent. - Review the use of third-party AI. Firms remain responsible for outcomes irrespective of whose model produced them. Vendor agreements, data access terms and the conditions on which external systems may initiate actions or trigger firm workflows all warrant review, alongside mapping which providers are critical dependencies and testing whether existing impact tolerances survive AI-specific failure scenarios.
The FCA is preparing a publication on good and poor practice in AI use in financial services, expected later this year, informed by direct industry engagement. Early investment in AI governance is likely to leave firms better placed to deploy AI confidently and comply with evolving regulatory obligations.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.