The Mills Review: the FCA plants a flag on agentic AI
The FCA has published the Mills Review, the first regulator-led study globally into how AI will reshape retail financial services by 2030. Its seven recommendations, and the FCA's endorsement of a principles-based approach, force boards to confront agentic AI as a live governance question rather than an innovation project.
On 6 July the FCA published the Mills Review, described as the first work of its kind initiated by a regulator globally, setting out how AI will reshape retail financial services by 2030 and beyond (FCA). Commissioned by the Board and led by executive director Sheldon Mills, the review identifies four AI-driven shifts: firm operations, consumer journeys, competition and market power, and the amplification of fraud and cyber risks (FCA). The signal to industry is that the regulator intends to shape the direction of travel rather than react to it.
The most consequential finding for boards is the consumer demand data. FCA-commissioned research shows a fifth of people, equivalent to 11 million UK adults, are likely to use AI that can act autonomously within pre-set goals, though respondents flagged concerns about trust and control (FCA). That is a material addressable market for agentic finance, and it arrives before most firms have clarified accountability for autonomous decisions made on a customer's behalf. Sheldon Mills said AI 'will transform financial services by 2030' and framed the report as 'a roadmap for how industry regulators and government can prepare for the next phase of AI-driven change' (FCA). Boards that treat this as a technology memo will misread the intent.
The seven recommendations tell senior leaders where the perimeter is moving. They include securing and adapting the regulatory perimeter, monitoring the transition to autonomous models, scaling the FCA's AI Lab, enabling the foundations for agentic finance, and building an AI-enabled agentic supervisory model (FCA). Two points matter. First, the FCA is preparing to supervise using AI, which changes the pace and granularity of oversight firms should expect. Second, Chair Ashley Alder confirmed the regulator will continue relying on 'the Consumer Duty and Senior Managers Regime' as the anchors for AI oversight (FCA). There will be no bespoke AI rulebook to hide behind. Named individuals will carry the accountability for model behaviour, customer outcomes, and third-party dependencies.
For stakeholder dynamics, the review reshapes three conversations at once. With customers, firms need a defensible position on autonomous action, given the trust and control concerns already surfaced. With investors, the competition and market-power theme raises the prospect of concentration risk around a small number of model providers, a topic boards should be able to discuss with precision. With the regulator, the invitation to test AI in the FCA's Lab is now a soft expectation: firms not engaging will find their assumptions tested less charitably in supervision. The fraud and cyber amplification finding also lands directly on operational resilience committees, which should already be revising threat models to reflect agentic attackers and agentic defenders on both sides of the perimeter.
The practical implication is straightforward. Consumer Duty and SMCR are now the operating manuals for AI governance in UK retail finance, and the FCA has told boards where it expects them to be by 2030. Firms that wait for detailed rules will be supervised against the Mills Review anyway.
What this reveals
The Mills Review exposes a governance gap that most boards have not yet closed: agentic AI is being treated as an innovation or technology workstream, while the FCA has quietly repositioned it as a live accountability question under existing regimes. The assumption that a bespoke AI rulebook will eventually arrive to define the perimeter has failed; the perimeter is Consumer Duty and SM&CR, applied to autonomous decisions firms have not yet mapped to named individuals. Other leadership teams likely believe their AI governance is proportionate because deployment is limited, missing that customer demand, third-party model dependencies and supervisory AI tooling will move faster than their internal accountability structures. This matters beyond any single firm because the divergence between what regulators now expect and what boards currently evidence will become visible in supervisory engagement long before it becomes visible in enforcement.
Questions accountable leaders should ask
- 01Which named Senior Manager currently carries accountability for decisions made autonomously by AI on behalf of customers, and can they evidence the controls behind that accountability?
- 02How would your firm demonstrate Consumer Duty outcomes for a customer journey where an agentic model acted within pre-set goals but produced a poor outcome the customer did not anticipate?
- 03Where in your AI estate do you rely on third-party models or agents whose behaviour you cannot fully explain to a supervisor, and who owns that dependency at board level?
- 04Has your board tested whether its current view of AI risk matches what the FCA's AI Lab and supervisory tooling are likely to surface in the next 12 to 24 months?
- 05If the FCA asked tomorrow for evidence of how you monitor the transition from assistive to autonomous AI, what would you actually be able to hand over?
What accountable leaders should do now
- 1Commission a mapping of every AI and agentic use case against named Senior Managers, Consumer Duty outcomes and third-party dependencies, and identify where accountability is currently unassigned or diffuse.
- 2Reframe AI at board level from an innovation portfolio item to a standing governance agenda item, with reporting that connects model behaviour to customer outcomes and supervisory expectations.
- 3Pressure-test the firm's assumptions about how the FCA will supervise AI, using external intelligence rather than internal consensus, and identify where board confidence is running ahead of evidence.
- 4Establish a forward view of the seven Mills recommendations, translating each into concrete implications for your operating model, controls and disclosures over the next 18 months.
- 5Before scaling any agentic customer journey, run a structured challenge on whether the trust and control concerns surfaced in the FCA's consumer research have been designed out, not just documented.
Explore the practical guide
A practical guide to building Consumer Duty evidence that withstands board challenge and FCA scrutiny. After reading, you will know what good evidence looks like, where most firms fall short, and how to structure your annual board report so it earns trust rather than questions.
Read the guideWhere internal confidence may exceed external evidence
Polar Insight helps leadership teams test critical assumptions against stakeholder, market, regulatory, and operational reality before risk compounds.
Explore Stakeholder ProximityRelated insights
Consumer Duty enters its evidence phase: outcomes monitoring becomes the board test
The FCA has published its review of how firms are approaching outcomes monitoring under the Consumer Duty, signalling that data collection alone will no longer satisfy supervisors. For senior leaders, the bar has shifted from having a framework to proving it changes decisions and prevents harm.
Motor finance claims: the FCA turns its fire on the intermediaries
The FCA and its taskforce partners have removed or amended 1,200 misleading car finance claims adverts since January 2024, tightening the screws on claims management companies and law firms feeding off the redress scheme. For lenders, insurers and their boards, the intervention reshapes who bears reputational and operational risk as the motor finance saga moves into its payout phase.
Consumer Duty product governance: the FCA raises the bar on design discipline
The FCA's July review of product governance under the Consumer Duty finds encouraging progress but persistent inconsistency in how firms design, monitor and distribute products. For boards, the message is that Duty compliance is shifting from policy documents to demonstrable design discipline, with vulnerable customers as the reference case.
Stakeholder Signals
Consequential developments in financial services and other regulated markets, with one implication for accountable leaders.