For almost all of our clients in the FS sector, the increasing adoption of generative AI tools and agentic AI systems across the wider market, and their own clients is presenting new challenges to internal governance, risk and compliance arrangements.

Over the course of this year, there have been a series of landmark publications addressing the role of the Prudential Regulation Authority and Financial Conduct Authority (FCA) in regulating the increasing use of these AI systems by firms themselves; and in setting expectations of firms in their interactions with market counterparties and clients who are also increasingly engaging with the firm either with, or through, their own agentic systems.

We covered the findings of the Mills Review, published in July this year, in our earlier blog post here. I covered some of the pressure points and ways forward for firms in connection with increasing consumer adoption of agentic AI tools in an earlier ‘vodcast’ with my partner and Head of Information Governance, Privacy and Cybersecurity, Marcus Evans. You can still access that here (although – given the pace of change in the technology, its use by firms and our wider work in this area, it is ready to be updated…).

The Mills Review set down a series of challenges and seven recommendations for the FCA. It arrived after some criticism of the regulators by the Treasury Select Committee (the TSC or the Committee) in January, when it called for greater clarity from the regulators on their expectations of firms’ use of AI – particularly in the context of senior manager accountability. The MillsReview acknowledged that, through a developing “spectrum of autonomy”, a number of pressure points were likely to emerge in the regulatory system, including the regulatory perimeter itself.

On Wednesday this week, Nikhil Rathi, the FCA’s Chief Executive Officer, and Jessica Rusu, the FCA’s Chief Data, Information and Intelligence Officer appeared before the TSC to give evidence on the work of the FCA. The session gave an important update on the FCA’s work in response to the Mills Review, and is helpful to firms seeking to understand what is expected of them now by the FCA in connection with the increasing deployment of AI across financial services; as well as the direction of travel from the regulator in providing greater direct guidance on this in the near future. 

Firms across the entire sector will want to stay focused on this, as they grapple with the challenges of meeting the FCA’s expectations in an increasingly ‘outcomes-focused’ and ‘principles-based’ regulatory environment. Three themes emerge from the TSC this week:

Agentic AI, advice and the perimeter

The FCA has acknowledged the clear potential for agentic systems’ output to amount to regulated financial advice. However, there is no clear signal that the FCA is moving to hold model providers themselves to account in this regard; rather acknowledging the “blurry boundary” surrounding regulated financial advice and that it is an area which is under scrutiny at the FCA. The FCA CEO has, however signalled the possibility of a "perimeter shift" here, acknowledging that this question is part (albeit an important one) of a wider debate concerning the provision of advice to consumers by AI models and their providers, through orchestration and access layers from other providers (for example, medical advice). 

The Committee explored the ways in which individuals now use AI to write their own financial plan. Against the backdrop of the Targeted Support regime, the FCA CEO offered a view concerning the application of the financial services framework to the models themselves but noted "that is ultimately a question for Government and Parliament" and suggesting that, in his view, models (and model providers) may not, currently, be at risk of carrying on regulated activities and that “drawing the boundary” remains a question to be answered.

In our view, firms – particularly those involved in “execution” of transactions, be that in investment business, regulated mortgage contracts or elsewhere in retail financial services – will need to have a very clear view of the extent to which consumers may have accessed such tools to aid their decision-making; whether or not this could have amounted to regulated advice and how they will make customers aware of the risks of transacting on this basis; given the potential for significant customer harm. Clearly, firms across the retail environment will wish to keep close to the FCA’s own work in this area to inform their own approaches.

Firms with retail customers should be considering client-side use of AI systems (agentic and non) and, in-step with the Consumer Duty, reviewing their customer journeys and documentation in particular, to address these new behaviours.

Increasing autonomy

In discussion, Ms Rusu highlighted some of the ‘live debates’ concerning the risks surrounding increasing agent autonomy, which are being surfaced through the FCA’s work on Open Finance. For example – and developing the Mills Review schema around ‘agent autonomy’ driving particular risks and potential issues in the regulatory framework – the FCA’s evidence highlighted ‘Know Your Agent’; and whether agents can be reliably authenticated within the ‘harness’ of a risk management framework, which provides continuous conditional assurance of an agent. The FCA revealed that there were at least three agentic solutions being worked through in its AI lab at the moment – for example, personal planning and personal inventory management.  

Statements made by the FCA CEO that the risks to market integrity are now as great as he has ever seen them; and that the very technology enabling greater surveillance is simultaneously giving rise to significant risks of market abuse, will make startling reading for many firms and their senior managers. Drawing on the FCA’s first Technology Horizon Scan, financial crime and risk teams should assess the underlying evidence and information in the Mills Review and the FCA’s comments to ensure they effectively address future risks which may arise faster than has historically been the case.

Agentic supervision

Ms Rusu commented that “becoming an agentic regulator is part of our overall ambition”. Whilst there was no signal that the FCA would move from its previously stated position of relying on existing regulatory frameworks – such as the Consumer Duty – to regulate firms and the market in connection with the use of AI systems. Mr Rathi gave early examples of ways in which the FCA’s own agentic systems are being used to digest market surveillance and, increasingly, to interact with firms’ own agentic systems where discrepancies in information are identified. The intention is that this will facilitate more effective use of human resource by regulator and firms; but emphasises the expectation of increasing agentic interactions in what is, contextually, a very significant area of exchange. 

Firms can clearly expect to see greater automation of regulatory interactions but, in developing their systems and deploying them to meet regulatory reporting requirements and other interactions with the FCA, should do so with a clear eye on the wider context in which these exchanges take place and the rules and guidance which sit around them.