Agentic AI in Retail Finance: Governance Decisions for Boards Now

At a Glance

The FCA's Mills Review is not a new AI rulebook. It examines how more autonomous AI could reshape retail financial services and gives boards a practical prompt to define delegated authority, human intervention and outcome testing under the requirements that already apply.

The Mills Review, published in July 2026, identifies four major shifts and makes seven recommendations to the FCA Board, but these are not new rules. Instead, they signal the FCA's focus areas and provide an opportunity for firms to proactively align their AI governance with existing regulatory expectations, particularly those under the Consumer Duty. Firms should assess how agentic AI might alter operations, consumer journeys, competition, and fraud risks, preparing for a future where AI plays a more autonomous role in financial decision-making.

FCA research involving more than 5,000 consumers found that around one in five UK adults could be open to agentic AI making financial decisions within parameters they set. That finding does not predict adoption, but it makes consumer control, understanding and trust important design questions for firms considering more autonomous use cases.

Who This Matters To

This analysis primarily matters to retail financial services boards, risk and compliance leaders, and AI product owners within firms that either currently use or plan to implement artificial intelligence, particularly agentic AI, in consumer-facing financial decision-making processes. The Mills Review's scope covers how AI could change firm operations, consumer journeys, competition, market power, and fraud and cyber risk, making it relevant for any firm whose business model or customer interactions could be impacted by these shifts. This includes firms offering products such as savings, investments, lending, and insurance where AI might assist or delegate decisions.

The Mills Review makes recommendations for the FCA Board to consider; it does not create new firm obligations. Relevance therefore depends on the firm's actual AI use cases. A firm considering delegated financial decisions can map each use case to existing requirements, risk appetite and customer outcomes without suggesting that the review itself creates a new scope test.

What the Evidence Shows

Mills Review identifies key shifts and recommendations

The four shifts and seven recommendations are forward-looking evidence of issues the FCA Board has been asked to consider. MEMA's view is that firms can use them as scenario-planning inputs while keeping current obligations, management judgement and possible future regulatory action clearly separate.

Consumer openness to agentic AI

MEMA recommends that product teams distinguish the consumer mandate from the system's technical capability: what the customer authorised, what the system may execute, how the boundary is explained and what happens when an action is disputed or produces a poor outcome.

MEMA Perspective

MEMA recommends that boards initiate a comprehensive review of their firm's AI strategy, explicitly defining what constitutes 'agentic AI' within their operational context and establishing clear boundaries for its autonomy in financial decision-making. This involves a critical assessment of the firm's risk appetite concerning AI-driven delegation and how consumer parameters for AI decisions will be established, communicated, and monitored. Boards should seek assurance that the firm's ethical guidelines and regulatory obligations, particularly those related to consumer protection and market integrity, are embedded within the AI development and deployment lifecycle, ensuring alignment with the FCA's focus areas.

A key governance responsibility for boards is to ensure that robust accountability frameworks are in place for all AI-driven processes, especially those involving delegated decisions. Boards should demand evidence of continuous monitoring of consumer outcomes for fairness and transparency, and that the firm can demonstrate compliance with existing regulatory frameworks, even as AI capabilities evolve, reflecting the FCA's sustained interest in these areas.

MEMA helps firms apply regulatory developments through its ongoing FCA compliance support.

Further reading: the FCA's 2026 compliance priorities.

Governance Priorities

Questions Leaders Should Resolve

MEMA's view is that the assistance-versus-delegation classification should drive proportionate governance. Evidence could include an AI inventory, the approved mandate, affected customer groups, outcome measures, intervention points and the person accountable for restricting or stopping the use case. The inventory should also identify the data and external services on which the decision depends, the financial consequence of an error and the forum that approves a material expansion of the mandate.

MEMA recommends defining the role of human intervention for each delegated use case rather than assuming one universal 'human in the loop' model. The record should state when a person can review or reverse an action, how anomalies escalate, how the system is stopped and how the firm tests the effect on consumer outcomes. Scenario tests should cover an action outside the customer's mandate, a misleading explanation, a fraud attempt and a failed override, with exceptions assigned and retested before approval. Retain the test inputs, observed outcome, challenge and release decision so assurance can reproduce the conclusion.

Source Evidence

Disclaimer

This article is for general information only and does not constitute legal or regulatory advice. Firms should assess the application of regulatory requirements by reference to their permissions, products, customers and operating model.

How MEMA Can Help

MEMA can help firms translate regulatory change into practical controls, policies, monitoring activity and board evidence. Book a free scoping call to discuss what this development means for your firm.