FCA publishes AI good and poor practice and plans an agentic finance framework

The Financial Conduct Authority (FCA) on 19 October 2026 published good and poor practice on AI in financial services, drawn from its testing of firms this year. Jessica Rusu, the FCA's chief data, information and intelligence officer, set out the findings in a speech at the Bloomberg UK Policy Series the same day. She also said the FCA will work with industry, fellow regulators and frontier labs on "a trusted framework for agentic finance", covering agent identity, delegated authority, accountability and execution.

The examples give firms a working benchmark under existing rules. The FCA groups its findings under three headings: consumer centricity, accountability and governance, and operational resilience. Governance is the weak spot, and Rusu said it is where "too many firms are still under-investing". The FCA expects firms to have clear accountability, risk-based controls, human oversight, escalation triggers and "senior managers personally accountable for AI systems". The practice is "not intended to be static guidance" and will be updated as the technology evolves.

What the FCA saw in firms

- Good practice. One firm built a live list of vulnerability signals that its chatbot uses to flag consumers who may need more support to human advisers. Another set up an independent ethics panel to interrogate proposed AI use cases before deployment, including ownership, bias and controls.
- Poor practice on consumers. Firms developed AI tools "without a clearly defined need", excluded vulnerable consumers by default, overstated capabilities, or deployed automated customer journeys without enough testing. Rusu tied these to the Consumer Duty.
- Poor practice on governance. Firms retrofitted governance after deployment or failed to adapt monitoring as systems changed. "That is the wrong way around," she said.
- Resilience. Firms should stress-test AI systems, plan for failure, keep fallback options, understand supplier concentrations "including reliance on a single model", and have proper cyber insurance.

On 15 October the FCA updated its Consumer Duty findings for contracts for difference firms, highlighting concerns about overnight charges and customer understanding.

Agents, near-misses and disclaimers

Rusu said FCA rules already require firms to report major incidents, "and that must extend to significant AI failures and near-misses". She described near-miss reporting for agentic AI as a regulatory priority and said agentic systems need "continuous, conditional assurance", because a system safe at deployment may behave differently at scale, under stress or as its underlying models change. In Atlas's view, the near-miss remark is a stated expectation rather than a rule change, and firms should read it as an indication of where supervisory questions are heading.

On general-purpose large language models, Rusu cited FCA findings that four in five less-experienced investors aged 18 to 40 have used AI to help with investing. Only 40% of consumers correctly recognise that there is no recourse after acting on advice from a general-purpose AI tool. The FCA is "calling on AI providers" to give "clear, proportionate and consistent disclaimers". She said the FCA's answer "is not simply to expand our remit, but to make the existing boundary clearer".

The speech also updates the FCA's response to the Mills Review, which the FCA commissioned and published in July, on how AI could reshape retail financial services by 2030. The FCA is embedding six of the review's seven recommendations into live work. It will not build the public-interest financial capability tool the review suggested. Instead it will build on existing work, including IOSCO's first TechSprint, powered by the FCA's AI Lab, to help investors spot scams and challenge unreliable AI outputs.

The FCA is also extending its own use of AI. It is building AI tools to oversee the 60,000 anti-money laundering firms coming into its remit in 2028. It is also building a "market first responder agent" to supervise about 9,000 small wholesale markets transaction reporting firms. After launching its Handbook API in August, it is working on machine-readable data collection APIs.

Rusu said the FCA's joint AI survey with the Bank of England, which shows 86% of firms now use AI, will be published next week.