The Financial Conduct Authority has placed a definitive stake in the ground. With the publication of The Mills Review: AI and the Future of Retail Financial Services, led by FCA Executive Director Sheldon Mills and formally commissioned by the FCA Board, the UK regulator has produced what it describes — and what independent observers are already validating — as the first comprehensive assessment of artificial intelligence in retail financial services undertaken by a financial regulator anywhere in the world. The implications extend far beyond the United Kingdom. For every fintech founder, chief compliance officer, and board member with exposure to AI-enabled products, this document sets the terms of the next era.
A Spectrum, Not a Switch
The review's most immediately actionable contribution is the introduction of a five-level AI Autonomy Spectrum — a framework designed to help firms locate themselves on the continuum between human control and machine delegation. At Level 1, AI functions as a pure tool operated entirely on human demand: summarizing product terms, explaining account features, assisting developers with code. By Level 3, the dynamic inverts — the AI acts as a Consultant, leading comparative analysis and drafting switching plans while the human retains final authority over preferences and decisions. At Level 4, the AI prepares and executes independently, pausing only for explicit human sign-off at defined checkpoints, such as initiating open banking transfers or drafting Suspicious Activity Reports. At Level 5, the most advanced designation, the human becomes an Observer: AI continuously optimizes cash balances, resolves customer support tickets end-to-end, and flags anomalies purely by exception. As Mills himself frames it, "as AI moves from recommending to acting, and firms and consumers delegate more, risks shift from harm within a single firm towards system-wide harms." That single sentence encapsulates the entire regulatory challenge of the coming decade.
The Data Behind the Disruption
The review does not traffic in speculation. It grounds its structural arguments in hard survey data. A nationally representative poll of 5,026 UK adults found that one in five consumers — 20 per cent — are already open to allowing AI systems to make autonomous financial decisions on their behalf within pre-set parameters. That figure climbs to 28 per cent among individuals who already use AI tools regularly, a cohort that is growing rapidly. Consumer appetite is concentrated where financial complexity is highest: debt advice, pension management, and investment decisions. Vulnerable consumers in particular are gravitating toward structured AI pathways out of arrears, while others are seeking automated pension pot consolidation, contribution optimization, and portfolio rebalancing.
On the supply side, the numbers are equally striking. The review cites survey data showing that 81 per cent of financial firms are already adopting AI at some level, with 40 per cent operating at advanced stages of scaling. By 2030, the review projects that leading institutions will deploy AI not as a support layer but as primary infrastructure — processing information, underwriting credit, handling claims, and producing compliance evidence with minimal human initiation. This is not incremental digitization. It is a fundamental reordering of how financial institutions produce and deliver value.
The Competitive Fault Lines
The review identifies the emergence of a new gatekeeper class — the AI interface layer — as perhaps the most consequential competitive development of the decade. As consumers increasingly delegate financial management to general-purpose AI assistants, operating-system agents, or specialized autonomous platforms, whoever controls the interface controls product visibility, recommendation ranking, and ultimately the customer relationship. Traditional banking brands risk being reduced to backend utilities, their direct consumer relationships dissolved by intermediating agents they neither own nor govern.
In the United States, this dynamic is already taking shape. Platforms including Robinhood and Public are actively permitting clients to connect independent external AI agents to their portfolios to execute algorithmic trading strategies based on consumer-defined parameters. The regulatory infrastructure to oversee these arrangements at scale does not yet exist, which is precisely what makes the Mills Review's timing so significant.
Simultaneously, the review raises serious concerns about upstream concentration risk. Financial firms are growing structurally dependent on a small cluster of frontier AI model providers and hyperscalers — a dependency that raises urgent questions about vendor lock-in, sovereign data control, and the potential for correlated, system-wide failures if a single provider experiences outages or exploits. The review specifically references concerns around Anthropic's powerful model variants, which required strict metering due to fears of cybersecurity exploitation targeting Western banking infrastructure — a stark illustration of how quickly capability and threat can scale in tandem.
Governance Cannot Be Outsourced to an Algorithm
Critically, the FCA has chosen augmentation over replacement when it comes to its own rulebook. The regulator explicitly does not believe a new AI-specific regulatory framework is necessary. Instead, the Consumer Duty and the Senior Managers Regime (SMR) remain the foundational accountability architecture. Under the SMR, senior executives cannot delegate legal responsibility to an automated system. They must demonstrate that they have taken reasonable steps to govern automated workflows, monitor model drift, and audit complex third-party AI supply chains. Accountability, in the FCA's view, is not a function that can be scripted into a model's prompt.
To address systemic risks — particularly the risk of correlated AI behavior producing market-wide herding — the review recommends the adoption of an Agentic Supervisory Model built around seven priority recommendations. These include: securing and adapting the regulatory perimeter to evaluate large language models conducting financial activities; strengthening coordination with other sectoral regulators; scaling the FCA's AI Lab to support safe model innovation; establishing trusted agent protocols to enable agentic finance; and developing a public-interest AI financial capability service to deliver accessible, safe financial guidance directly to citizens. The FCA is not merely regulating the industry's use of AI — it is building its own agentic supervisory infrastructure to keep pace.
What This Means for the Industry
The Mills Review delivers a clear message: the transition to agentic finance is not a distant scenario to be planned for at leisure — it is already underway, and the regulatory framework that will govern it is being written now. Fintech executives who treat this review as an abstract policy document do so at their peril. The SMR's accountability requirements mean that board-level AI governance — covering model selection, vendor concentration risk, bias auditing, and consumer outcome monitoring — must be demonstrably in place, documented, and defensible. The five-level Autonomy Spectrum gives firms a practical diagnostic tool to assess where their current deployments sit and what governance obligations attach to each level. As consumer willingness to delegate autonomous financial decisions continues to rise — and the survey data confirms it is rising — the firms that build trust infrastructure now will hold structural competitive advantages by 2030. The question, as the review itself frames it, is no longer whether AI will be permitted. It is who the technology will ultimately serve — and who will be held responsible when it does not.
Written by the editorial team — independent journalism powered by Codego Press.