Technology Transactions Soundbite: The FCA Mills Review & its Agentic AI Finance Framework - The real message for UK Financial Services
The FCA’s Mills Review published on 06 July 2026 (The Mills Review: AI and the future of retail financial services) is not just another paper on AI; it's a milestone signpost that the architecture of UK retail finance is about to change. At its heart lies the question as to what happens when financial services moves from AI that passively advises to AI that acts in consumers' decision processes, and how the industry puts into place market infrastructure to safely allow this to happen.
We know what's coming: an AI agent that can compare savings rates, move spare cash, renew insurance, rebalance investments, manage bills or initiate payments within limits set by the customer. But before this can happen in line with current regulation and policy, the market needs clear consent, trusted identity, verifiable authority, allocated liability, lawful data access, secure payment execution and supervision.
Key messages from Mills on agentic AI are:
1. Firm-by-firm supervision is not enough to assess AI risks. We already see this with frontier models and Mythos/Fable 5 which itself arrived after the announcement of the Mills Review (indicating the pace of change). Regulated firms remain responsible for their services and customer outcomes, including where AI is involved. But AI harms may arise from shared models, common infrastructure, third-party providers and cross-market dependencies that no single firm can fully see. So, whereas the old question was: "does a firm have appropriate systems, controls and accountability?", the AI-era question is: "how does a firm and the ecosystem simultaneously assess and control risks across shared cloud providers, common foundation models, common data sources, similar model behaviours and interconnected agentic workflows?".
Added to this, the FCA has, thus far, said that it will not introduce new AI-specific regulations and will instead rely on existing frameworks, including Consumer Duty, SM&CR and expectations on governance and controls. But, as Mills notes, the risk is that accountability becomes harder to trace as influence over consumer outcomes moves outside the FCA’s regulatory perimeter and into the hands of a few, principally US based, LLMs. Mills explicitly recognises the strain that AI is having on UK financial services regulation in this approach. There is a useful heatmap showing where current SMCR, Op Res and Consumer Duty regulation will start to crack under the pressure of ever-developing AI models and use cases.
2. Agentic AI needs rules of participation and ambitious alignment. Mills explicitly calls for an agentic finance framework; its more technical formulation (a regulatory world first) proposes a trusted framework for AI agent participation in retail financial services. Therefore, agents can be authorised, identified, controlled and held accountable. There is explicit recognition that consumers need rules for consent mandates, identity, control and liability allocation before AI agents can support at scale.
The Review identifies the current fragmentation and various levels of maturity across data access, identity verification and payments infrastructure as a major constraint on safe end-to-end agentic finance. The key to unlocking real potential for wider society is unlocking these areas as well as leveraging more mature smart access systems such as Open Finance. It is thus unsurprising that Mills recommends developing trusted agent standards through Open Finance, rather than creating separate agentic finance regimes, either domestically or internationally.
The future of AI agents in UK finance may be built on existing policy foundations: smart data, open banking moving to open finance, digital identity and payments modernisation as part of the UK National Payments Vision. In other words, agentic AI, Data, Identity, Open Finance and Digital Assets viewed through one connected infrastructure lens. Ambitious to say the least.
Conclusion - the market will move before any rulebook
The Mills Review does not deliver a finished agentic finance framework - that was never its job. Its value is more pointed: calling out the state of the UK financial services and AI, the temperature of consumers in adopting AI, the limits of the current approach of "no new law" and identifying the missing architecture to effective, safe, consumer-led AI deployment.
It is clear that the regulatory centre of gravity in deploying AI in the UK retail finance has shifted. The best-placed firms will not, however, be waiting on those new AI rules; they will already be active participants in Mills' wider call-to-arms, embracing all the potential, and all the pitfalls, that an agentic AI future brings to bear.
