Community Trust ScoreVerified
The FCA is building AI supervision tools for 60,000 anti-money-laundering firms set to come under its oversight in 2028. Jessica Rusu, the agency’s chief data, information and intelligence officer, laid out the plan alongside a broader push to use AI across the regulator’s own operations — and to set clearer expectations for firms deploying the technology themselves.
Why It Matters
This matters because a regulator that can monitor a surge of newly supervised firms more efficiently is better positioned to reduce compliance gaps before they become systemic risks. For crypto and other financial services firms operating in or adjacent to the UK, it signals that AI-driven oversight is moving from a policy concept to a practical supervisory framework, likely raising expectations around data quality, controls, and auditability.
The timing matters. Sixty thousand is a big number. Bringing that many new firms into scope at once would strain any traditional supervisory model, and the FCA seems to know it. Rusu framed the AI tooling not as a luxury but as a practical necessity — a way to handle volume without simply throwing more headcount at the problem. The agency is also building what it calls a “market first responder” agent for roughly 9,000 small wholesale-market transaction-reporting firms, with the goal of freeing up supervisors to focus on more complex cases rather than routine triage.
Six of seven Mills Review recommendations are already moving into live work.
What the FCA Expects From Firms
The Mills Review, published in July, looked at how AI could reshape retail financial services by 2030. The FCA embedded six of its seven recommendations into ongoing work, including through its AI Lab, which gives the regulator direct visibility into systems firms are actually building — covering agent-led payments, fraud detection and consumer support.
The FCA’s review of firm practices zeroes in on three areas: consumer outcomes, governance and operational resilience. Under the Consumer Duty, firms are supposed to use AI in ways that genuinely support consumers — inclusive product design, clear choices, and a real path to a human when needed. Not all firms are getting that right.
One firm built a live list of vulnerability signals for its chatbot. The tool can flag customers who may need extra support and route them to human advisers. That’s the kind of thing Rusu wants to see more of. But the FCA also found firms creating AI tools without any defined need, excluding vulnerable consumers by default, overstating what their systems can actually do, and rolling out automated customer journeys without enough testing first.
AI should improve outcomes, Rusu said — not just automate whatever was already broken.
The FCA is publishing examples of good and poor practices drawn from firm testing this year. The regulator said it will update those examples as technology changes. Practical guidance, not another study. That’s pretty much the whole point.
Governance came up too. Firms need clear accountability, risk-based controls, human oversight and escalation triggers. Senior managers are personally accountable for AI systems under existing rules. One firm set up an independent ethics panel to examine proposed uses before deployment, looking at ownership, bias and controls. That’s good practice. What the FCA keeps finding instead: firms bolting governance on after deployment, or failing to adjust monitoring as systems evolve.
Rusu pushed firms to stress-test their AI, plan for failure and keep fallback options ready. She also flagged supplier concentration — specifically dependence on a single model — as a risk firms need to assess. And AI failures, she said, need to be reported. Existing rules already require firms to report major incidents; the FCA wants significant AI failures and near-misses included in that scope.
Consumers Using ChatGPT for Financial Advice
Consumers are already using general-purpose AI tools — ChatGPT, Gemini, Claude — for financial information and advice. Regulated firms are starting to integrate services into AI platforms too, which blurs the line between regulated activity and whatever protections consumers think they have.
The numbers are uncomfortable. Four in five less-experienced investors aged 18 to 40 have used AI to help with investing, per the speech. But only 40% of consumers correctly understand that they have no recourse if something goes wrong after acting on advice from a general-purpose AI tool. That’s a big gap.
The FCA’s answer isn’t to expand its remit. It wants to make the existing boundary clearer. Its InvestSmart campaign and FCA Firm Checker already help consumers figure out what protections apply. Rusu said warnings may land better when they appear at the exact moment AI-generated financial information is delivered — not buried somewhere else.
Rather than build a new public-interest financial capability tool — something the Mills Review proposed — the FCA plans to build on what it already has. Its AI Lab is powering IOSCO’s first TechSprint, aimed at helping investors spot scams, verify information and push back on unreliable AI outputs.
The regulator is also working with banks on frontier AI security, looking at how advanced models are changing cyber defence — including using AI to identify linked vulnerabilities and assist with triage, patching and recovery. Those findings feed into supervisory and policy work.
Agentic Finance Is Coming Fast
The FCA is preparing for AI systems that can act on a user’s behalf — searching across products, managing payments and investments, and transacting directly with other agents. That adds a whole layer of automated activity between financial firms and their customers. It’s murky territory.
Rusu said the FCA will work with industry, other regulators and frontier labs on a trusted framework for agentic finance. Areas under consideration include agent identity, delegated authority, accountability and execution. No details yet on timeline.
The agency is also using AI to gather evidence, pull together intelligence from different sources and flag early warning signs. Staff are being upskilled, and technology investment is ongoing. In August, the FCA launched its Handbook API, giving firms access to machine-readable rules they can run through AI tools. Machine-readable data collection APIs are also in the works.
The 60,000 AML firms coming in 2028 won’t supervise themselves.
Frequently Asked Questions
How many firms will enter the FCA’s remit in 2028?
About 60,000 anti-money-laundering firms are set to enter the FCA’s remit in 2028, and the regulator is building dedicated AI tools to handle their oversight.
What did the FCA identify as good AI practice for financial firms?
One firm built a chatbot with a live list of vulnerability signals that can flag customers needing extra support to human advisers — the FCA cited it as a positive example alongside an independent ethics panel set up by another firm to review AI deployments before launch.
