The Mills Review: prepare now to keep pace with AI

Background

In January 2026, the FCA Board commissioned Sheldon Mills, outgoing executive director at the FCA, to conduct a review into how advances in AI could transfer retail financial services by 2030 and beyond. The Review, which was published on 6 July 2026, considers the immense opportunity that AI offers to financial services, alongside important questions about regulatory topics such as the evolution of regulation, supervision and governance that will be necessary to manage the potential associated risks to the financial system and the economy.

AI's role in financial services

The Review envisages an AI-enabled financial services system. It expects that the current large, general-purpose AI models will scale in three ways: (i) combining neural networks with rules, logic or formal methods; (ii) continuously learning from new data without forgetting; and (iii) representing how an environment works to anticipate the effects of actions. Over the longer term, future systems will build on these foundation models. 

In this context, the Review uses the concept of an AI "autonomy spectrum", with five levels, to describe the possible role of AI and the corresponding role of humans within the loop. In order of least to most agent autonomy (and acknowledging that not all use cases will move along the full length of the spectrum):

Applying the spectrum, the Review identifies some of the specific transformations that AI could bring to a firm's activities in the areas of operations, front office, and risk and compliance functions. 

The Review also considers how AI could be deployed across retail markets, suggesting some examples and potential market impacts in retail banking, insurance, consumer finance, savings and investments, pensions and payments.

New benefits, new risks

From a consumer perspective, surveys conducted for the Review revealed that there is emerging demand for automated financial decisions, with one key benefit being heightened personalisation of advice and products. However, this brings new risks, including widening the accessibility gap, opaque decision-making and amplification of biases. There are also significant considerations around accountability. These matters sit alongside another key risk: increased financial crime and cybersecurity risk, as AI enables highly personalised manipulation, fraud and deceptive design. 

From a market perspective, AI increases competition by facilitating additional interfaces for consumers to buy and access retail financial services. At the same time, control of and access to AI-powered customer interfaces will become a major source of market power. Further, there are additional points of concentration throughout the AI supply chain such as hyperscalers, model providers and chip manufacturers. The key risk is that, due to fixed costs of AI investments, AI may systematically benefit large incumbents.

Having considered the key ways in which AI could transform financial services, the Review focuses on the potential regulatory implications. For the FCA as regulator, the Review identifies that the most significant change to monitor is at system level, where shared AI dependencies create ecosystem-level risks, i.e. risks that sit outside the firm-level supervisory framework. As AI involvement within financial services becomes increasingly autonomous, pressure points and regulatory framework mismatches could emerge. 

The Review states that the UK regulatory framework, which is principles-based and outcomes-focused, offers a "credible foundation for an AI-enabled financial system", while the FCA's current approach puts it in a good position to proactively adapt to AI (the Review specifically highlights the Consumer Duty and the AI Lab as exemplifiers of this). However, it concludes that supervision will need to go beyond the level of the firm to take in the financial ecosystem as a whole. Under this 'Agentic Supervisory Model' (see recommendation 6: build and adopt an AI-enabled supervisory model), supervision of individual firms would be supplemented by system-wide monitoring and AI-enabled supervisory capabilities for regulators. 

Transformed regulatory approach: what this means for firms

The Review puts forward seven priority recommendations that may inform the FCA’s regulatory approach going forward. They cover four broad areas, which are interconnected: regulatory frameworks and perimeter; supervision and coordination; foundations and capability; and consumer access and outcomes. 

Among these, recommendation 3 (“monitor the transition to autonomous models and adapt regulatory frameworks”) has directly relevant implications for firms. 

The practical takeaways in this regard include:

• Governance. Effective AI governance is expected to become a core capability. Firms’ governance arrangements should adapt to extend beyond validation at the point of deployment. This requires a more dynamic governance framework that monitors outcomes on a continuous basis and tracks drift, degradation and outliers. Firms should be able to show evidence of how Consumer Duty outcomes are met within the customer journey, how Senior Managers demonstrate reasonable steps and how accountability is exercised, and support these governance arrangements with robust escalation mechanisms. This will call for firms to ensure that their risk and compliance teams are staffed by people who understand AI-enabled journeys, who can challenge AI-enabled workflows, and effectively escalate when issues emerge. 
• Operational resilience. Firms should adapt in terms of third-party relationships and procurement, particularly with AI model providers and adjacent vendors. The increase in dependencies (possibly even direct interaction with the infrastructure) means that firms should develop the capabilities to manage external AI systems, including those systems’ access to data and ability to initiate actions or trigger workflows. Ultimately, firms remain responsible for outcomes, even where external models or infrastructure are relied upon.
• Consumer Duty. As AI becomes increasingly autonomous and agentic in its deployment, firms will need to continuously assess against Consumer Duty outcomes to ensure that consumers are able to oversee, understand and challenge AI-driven decisions. 
• Financial crime and cyber risks. Firms should ensure that their defensive capability is sufficiently uplifted to match the heightened fraud risk and cyber risk posed by AI. 

Next steps

The FCA Board will now consider, with the Executive, the recommendations made under the Review and confirm which (if any) the FCA plans to take forward over the coming months and years. The Review calls for action across the four broad areas covered by the recommendations, on the basis that this will be necessary to balance the risks and opportunities of AI for financial services. 

Meanwhile, the FCA is developing a publication on good and poor practice in AI use in financial services, which it will publish later this year. This is a separate workstream and the FCA has been engaging directly with industry to establish what firms feel is working well, where there are challenges, and the themes and topics they would like to see the FCA address. While the content of the publication is not yet known, it is interesting in this context to note the comment in the Review that, while engagement respondents did not seek changes to the overall regulatory framework, they did want "clarity on how to interpret and govern increasing use of AI within the existing regime".

Please get in touch if you would like to discuss the Review or any issues it raises in the context of your firm's AI strategy or regulatory obligations.