The Financial Conduct Authority (FCA) is the United Kingdom's conduct regulator for financial services firms and markets. In AI policy it is the originator of the regulatory-sandbox model that AI-specific sandboxes descend from, and — with the July 2026 Mills Review — the publisher of what it describes as the first regulator-initiated review globally into how AI could transform retail financial services (Source: fca.org.uk).
| Type | UK statutory conduct regulator (financial services) |
| Chair | Ashley Alder (as of July 2026) |
| AI-relevant programs | Regulatory Sandbox (2016–), AI Lab, AI Live Testing, Supercharged Sandbox |
| Key AI publication | The Mills Review (July 6, 2026) |
Sandbox lineage
The FCA launched the original regulatory sandbox in 2016, admitting fintech and increasingly AI-driven firms to test products with real consumers under individually negotiated restrictions. The model relies on waivers, individual guidance, and informal steers rather than statutory enforcement suspension, and became the template from which AI regulatory sandboxes in other jurisdictions descend (AI Regulatory Sandbox).
AI program
The FCA's AI work spans its AI Discussion Paper and feedback statement (FS23/6), an AI Sprint, and the AI Lab, which includes AI Live Testing (a second cohort was announced in 2026) and the Supercharged Sandbox supported by Nvidia (Source: fca.org.uk). On July 21, 2026, the FCA announced that Anthropic will support the second Supercharged Sandbox cohort of 21 organizations, with applications up 51% year over year (Source: fca.org.uk). The regulator characterizes its approach to AI as principles-based and outcomes-focused, relying on the Consumer Duty and the Senior Managers Regime rather than AI-specific rules. A publication on good and poor practice in firms' AI use is planned for later in 2026.
The Mills Review (July 2026)
Commissioned by the FCA Board in January 2026 and led by executive director Sheldon Mills, the Mills Review — "AI and the future of retail financial services" — was published July 6, 2026. It examines how AI could reshape retail financial services for consumers, firms, markets, and regulators by 2030 and beyond, and identifies four AI-driven shifts: transformation of firm operations, evolution of consumer journeys, reshaping of competition and market power, and amplification of fraud and cyber risks (Source: fca.org.uk).
An April 2026 Yonder Consulting survey of more than 5,000 UK retail financial services consumers, commissioned for the review, found 20% of consumers — equivalent to roughly 11 million UK adults — would be likely to use AI capable of acting autonomously within pre-set goals, while expressing concerns about trust and control. The review makes seven recommendations to the FCA Board and Executive: secure and adapt the regulatory perimeter; strengthen system-wide coordination and oversight; monitor the transition to autonomous models and adapt regulatory frameworks; scale up the AI Lab; enable the foundations for agentic finance; build and adopt an AI-enabled agentic supervisory model; and develop a trusted public-interest AI-enabled financial capability service (Source: fca.org.uk).
The review concludes that AI is likely to become a defining force in retail financial services — improving access, personalisation, and efficiency while potentially amplifying risks of fraud, cyber insecurity, consumer harm, and market concentration.
The review's own text (The Mills Review: AI and the future of retail financial services (FCA, July 2026)) organizes this around an AI autonomy spectrum. Its projection is that firms today deploy AI for specific tasks "mostly keeping humans in the loop," but that "by 2030 many could have moved significantly further along the autonomy spectrum, embedding AI into almost every function from customer support and underwriting to compliance, claims and product design," with AI becoming for leading firms "the main method by which they process information, serve customers, and evidence outcomes."
The consequence the review draws for supervision is that human oversight changes in kind rather than degree: the role of people moves "from operators close to each decision, towards collaborators, approvers and, eventually, observers who monitor outcomes and step in when systems move outside agreed parameters." It describes this as "a substantial organisational shift, requiring new skills and a clearer account of what human oversight actually involves" — a regulator's statement that the human-in-the-loop condition common across AI regulation lacks a definition adequate to the deployments it governs.
Frontier AI and cyber resilience (August 2026)
The FCA published a multi-firm review, "Frontier AI and cyber resilience," on August 26, 2026, revised September 2 (Frontier AI and cyber resilience (FCA multi-firm review, August 2026)). It follows a joint statement by the FCA, the Bank of England and HM Treasury of 15 May 2026 describing frontier models as "a step-change in capability, with significant implications for cyber security and operational resilience" (Joint statement on frontier AI models and cyber resilience (FCA, Bank of England and HM Treasury, May 2026)), and reports what firms told the regulator about using, testing and preparing for models with cyber capabilities.
The joint statement is the FCA's principal expectation-setting communication on frontier AI to date. It holds that current frontier models' cyber capabilities already exceed what a skilled practitioner could achieve, attributing that judgement by hyperlink to the AI Security Institute, and asks firms to act across governance and strategy, vulnerability identification and remediation, third-party and supply-chain risk, protection, and response and recovery. It rests on the FCA's existing operational-resilience rules in PS21/3 and states in a footnote that it introduces no new expectations.
The review is a summary of firm-reported observations rather than the regulator's own testing, and states its status expressly: "This publication summarises observations reported by firms during our engagement. It does not introduce new rules, guidance or regulatory expectations." It is the publication on good and poor practice in firms' AI use that the AI programme had signalled for later in 2026, in the cyber-resilience slice.
Its five insight themes are that vulnerability discovery is accelerating faster than firms' ability to respond; that frontier AI is becoming a test of organisational resilience rather than only a tool, with organisational readiness "the primary challenge"; that the value firms obtain depends on the deployment environment — governance, tooling, controls, human oversight, what the review calls "the harness" — more than on which model is used; that foundational cyber and operational resilience are becoming more important; and that governance and human judgement remain central. Firms reported that models can chain multiple lower-rated flaws into alternative routes to compromise, shifting prioritisation from severity ratings toward the disruption an exploited attack path would cause (Frontier AI and cyber resilience (FCA multi-firm review, August 2026)). See Financial Services — AI Deployment, Autonomous cyber-agents.
Relationships
- related: The Mills Review: AI and the future of retail financial services (FCA, July 2026) — the review's primary text
- related: Frontier AI and cyber resilience (FCA multi-firm review, August 2026)
- related: Bank of England (BoE)
- related: Agent Autonomy Spectrum (5 Levels) — the review's organizing frame
- related: AI Regulatory Sandbox — the FCA sandbox is the model's origin
- related: Financial Services — AI Deployment — the sector the FCA regulates and the Mills Review addresses
- related: UK Information Commissioner's Office (ICO) — fellow UK regulator with overlapping AI remit