The Mills Review 

What is the Mills Review and why it was undertaken?

In July 2026 the FCA published its report entitled "AI and the future of retail financial services", led by executive director Simon Mills. The Mills Review examines how autonomous artificial intelligence could increasingly reshape retail financial services and regulatory oversight. It does not recommend new authorisation criteria, but it does highlight how existing obligations should be applied to firms using delegated or agentic AI systems.

The Mills Review looks at how firms are likely to delegate increasing amounts of financial decision-making to AI systems that recommend actions, initiate transactions and execute decisions within agreed parameters. The impact of this upon consumers is implicitly obvious. The Mills Review follows from the FCA's existing work in relation to the proliferation of AI in the industry, and treats agentic AI as having the potential to fundamentally transform how financial services operate. 

In parallel with the Mills Review, the FCA has recently conducted a multi-firm review of frontier AI models and cyber resilience, examining how firms are “using, testing and preparing for frontier AI models with cyber capabilities”, and the implication for firms’ safety, soundness and operational resilience. This multi-firm review was considered in the Mills Review.

Current legislation and regulation suffices to govern the development of AI tools in regulated businesses

The Mills Review assessed how the Consumer Duty, the Senior Managers Regime and the newer operational resilience and critical third parties requirements apply as AI use becomes more widespread. The Mills Review concluded that these existing frameworks are flexible enough to cope with growing AI autonomy, on the basis that FCA-regulated firms remain answerable for the outcomes their AI systems produce.

i. Consumer Duty

The key findings in the Mills Review note that retail financial services are shifting away from human-led towards AI-enabled, continuous and delegated services, and whilst AI has the potential to improve outcomes and support growth, it also has the potential to increase risks associated with fraud, cyber-security and consumer harm. These are outcomes that the Consumer Duty already requires firms to manage for retail customers. As such, the Consumer Duty already provides the ongoing conduct standard against which AI governance will be measured, and is not in need of amendment to address special circumstances.  In fact, the manner in which the Consumer Duty penetrates to the level of firms whose primary focus is B2B services (but where the ultimate beneficiaries of those services are themselves consumers) is also satisfactorily captured under the Consumer Duty as presently regulated.

The FCA's parallel review of frontier AI and cyber-resilience shows what meeting that standard looks like in practice.  In summary, the value and safety of frontier AI depends less on the model itself and more on the operational environment around it, including specialist tooling, robust validation processes, operational guardrails and human expertise. Importantly, the cyber-resilience review that the Mills Review itself considered, concludes that without these controls, “models can generate large numbers of findings that are technically possible but difficult to validate, prioritise or act upon”.

For firms deploying agentic AI in trading execution, onboarding or automated risk decisions, it is therefore likely that the FCA will focus not on whether a model is sophisticated, but on whether the firm has built permission limits, approval gates and validation capacity to prevent volume and autonomy from outpacing genuine oversight.  Put more simply, firms will be expected to use and oversee their AI tools and usage and ensure that none of this jeopardises current Consumer Duty compliance requirements.

ii. SMCR 

The Review also confirms that Senior Managers retain accountability over agentic or autonomous systems.  Senior Managers remain responsible for the outcomes an AI system produces, even where its behaviour, updates or performance depend in part on a third-party model provider outside the firm's direct control. 

This means that firms must identify both the individual who is personally responsible for each AI-driven process and how that person monitors that process on an ongoing basis.  This obligation exists under the current framework; it is not in need of enhancement with respect to the importation of AI.

iii. Operational resilience and critical third parties

The cyber-resilience review found that as AI capabilities develop, firms may need to consider whether their governance and escalation routes are sufficiently responsive, with governance forums, risk committees and senior leaders needing clear understanding of how the imported AI tools in practice affect risk and operational resilience.

The Mills Review links operational resilience to a growing reliance on third-party model, cloud and infrastructure providers, noting that concentration in a small number of such providers raises system-wide resilience questions connected to the critical third parties regime and to the need for stronger coordination between regulators. This is reflected in seven priority recommendations made in the Mills Review, including securing and adapting the regulatory perimeter and strengthening system-wide coordination and oversight.

The risks associated with reliance on generic online AI tools

The Mills Review identifies a gap in the existing regulatory framework, arising from the premise that UK financial regulation is activity based rather than technology based.  It identifies that many of the general-purpose AI tools consumers are turning to for financial decisions, such as ChatGPT, Claude or Gemini, sit outside the FCA's authorisation perimeter altogether, making it more difficult to establish who is accountable if something goes wrong. 

In other words, whilst the Consumer Duty and SMCR obligations attach cleanly to AI used within the regulated activities of firms that FCA regulates, investors nowadays also  separately use  unregulated general-purpose tools, either alongside or at times in substitution for a firm's own services. That risk is flagged in the Mills Review as a current gap in the regulatory perimeter that the FCA is actively reviewing.  However, the premise at the moment is that ChatGPT  and other such general purpose AI tools  are not subject to regulation and FCA can only publicise the fact that those seeking to rely on “advice” that AI agents proffer to the market at large are not entitled to any degree of regulatory protection.  Whether it is practical to make these AI agents (or the companies behind them) subject to regulation is not at all clear, and will likely require cooperation at an international level across multiple jurisdictions.

Key takeaways for regulated firms

Firms will be expected to evidence clear lines of responsibility, escalation routes and human oversight over their proprietary or licensed AI systems, rather than describing AI governance in abstract terms.  The practical checklist that emerges from these reviews includes: a clearly accountable Senior Manager for each AI-driven process, defined escalation routes when an AI agent's output or behaviour falls outside expected parameters, demonstrable human judgment over any automated process affecting customers, and monitoring that is sufficient to catch model drift or degraded outcomes before they cause harm.  The basis upon which all of these factors operate will also play into the manner in which the firm manages its complaints procedures.

Key takeaways for firms seeking authorisation under the new cryptoassets regime

The parallel reviews of frontier AI and cyber resilience do not introduce new rules, guidance or regulatory expectations.  However the Mills Review does signal that the Regulator is not treating AI as a peripheral technology question.  The shift toward autonomous, delegated decision-making as a structural change to the sector raises a series of factors that authorisation processes, supervision and the regulatory perimeter itself will need to adapt to.  A cryptoassets firm preparing an authorisation application should: 

1. Treat the Consumer Duty as a binding conduct standard for AI use once authorised; 
2. Be prepared to name the Senior Manager(s) accountable for each AI-driven process, especially where that process relies on a third-party model provider; 
3. Build the necessary governance, guardrails and validation capacity into the authorisation application itself, particularly for any agentic AI used in onboarding, trading execution or risk decisions; and 
4. Consider as best it can how the firm's own AI tools may be presumed to interact with independent use of unregulated general-purpose AI tools.