Agentic finance arrives: the FCA signals testing over consultation

The FCA has drawn a line under the consultation phase of AI supervision. In a speech at Bloomberg's UK Policy Series on 19 October, chief data, information and intelligence officer Jessica Rusu told firms the regulator's response to the Mills Review will be "testing, assurance, monitoring and surveillance" rather than further study, with six of the seven recommendations being embedded into live work immediately (FCA).

From principles to inspection

The shift matters because it changes who carries the burden of proof. The Mills Review, published in July, examined how AI could reshape retail financial services by 2030, and Rusu noted some of its anticipated developments, including agentic finance such as the launch of Meta's Muse, are already arriving (FCA). The joint FCA and Bank of England AI survey, due next week, shows 86% of firms now use AI (FCA). That adoption rate removes any argument that AI governance is a specialist concern. It is now a mainstream supervisory expectation.

Rusu's framing, that firms should "put consumers first, maintain clear accountability and plan for when things go wrong" (FCA), reads as the three-part test supervisors will apply. Each element has operational consequences. Consumer-first means outcome testing against the Consumer Duty, not model performance benchmarks. Clear accountability means a named Senior Manager, with a defensible understanding of what the system does and does not do. Planning for failure means tested rollback procedures and liability allocation that works when an agent transacts on a customer's behalf and gets it wrong.

The agentic problem

The harder question is agency. When a model recommends, a human still decides. When an agent executes, the human has already delegated. The FCA's AI Lab, Rusu said, is giving the regulator "direct insight into what firms are building from agent-led payments and fraud" (FCA). Firms piloting agentic tools should expect those pilots to be examined, with questions about authorisation scope, consent architecture and redress pathways. The absence of a dedicated agentic rulebook is not a gap. It means existing rules, Consumer Duty, SM&CR, operational resilience, will be read onto agentic systems as they are.

The wholesale read-across is explicit. Rusu noted the AI shift "does not stop at the retail boundary" and is accelerating how firms analyse, trade, monitor and make decisions (FCA). Asset managers and sell-side firms running AI in execution, surveillance or research functions should assume the same assurance posture applies, even where consumer-facing rules do not.

What boards should do now

The practical implication is a shift in evidentiary posture. Boards accustomed to signing off AI policies will be asked for evidence of AI operation: logs, test results, incident data, override rates. The regulator is becoming, in Rusu's phrase, "a smarter regulator, using AI in its own work" (FCA). That almost certainly means pattern detection across firms. Outliers will be visible.

The window for firms to decide their own AI assurance standard, before supervisors arrive with theirs, is closing.