The Mills Review: the FCA plants a flag on agentic AI

On 6 July the FCA published the Mills Review, described as the first work of its kind initiated by a regulator globally, setting out how AI will reshape retail financial services by 2030 and beyond (FCA). Commissioned by the Board and led by executive director Sheldon Mills, the review identifies four AI-driven shifts: firm operations, consumer journeys, competition and market power, and the amplification of fraud and cyber risks (FCA). The signal to industry is that the regulator intends to shape the direction of travel rather than react to it.

The most consequential finding for boards is the consumer demand data. FCA-commissioned research shows a fifth of people, equivalent to 11 million UK adults, are likely to use AI that can act autonomously within pre-set goals, though respondents flagged concerns about trust and control (FCA). That is a material addressable market for agentic finance, and it arrives before most firms have clarified accountability for autonomous decisions made on a customer's behalf. Sheldon Mills said AI 'will transform financial services by 2030' and framed the report as 'a roadmap for how industry regulators and government can prepare for the next phase of AI-driven change' (FCA). Boards that treat this as a technology memo will misread the intent.

The seven recommendations tell senior leaders where the perimeter is moving. They include securing and adapting the regulatory perimeter, monitoring the transition to autonomous models, scaling the FCA's AI Lab, enabling the foundations for agentic finance, and building an AI-enabled agentic supervisory model (FCA). Two points matter. First, the FCA is preparing to supervise using AI, which changes the pace and granularity of oversight firms should expect. Second, Chair Ashley Alder confirmed the regulator will continue relying on 'the Consumer Duty and Senior Managers Regime' as the anchors for AI oversight (FCA). There will be no bespoke AI rulebook to hide behind. Named individuals will carry the accountability for model behaviour, customer outcomes, and third-party dependencies.

For stakeholder dynamics, the review reshapes three conversations at once. With customers, firms need a defensible position on autonomous action, given the trust and control concerns already surfaced. With investors, the competition and market-power theme raises the prospect of concentration risk around a small number of model providers, a topic boards should be able to discuss with precision. With the regulator, the invitation to test AI in the FCA's Lab is now a soft expectation: firms not engaging will find their assumptions tested less charitably in supervision. The fraud and cyber amplification finding also lands directly on operational resilience committees, which should already be revising threat models to reflect agentic attackers and agentic defenders on both sides of the perimeter.

The practical implication is straightforward. Consumer Duty and SMCR are now the operating manuals for AI governance in UK retail finance, and the FCA has told boards where it expects them to be by 2030. Firms that wait for detailed rules will be supervised against the Mills Review anyway.