Knowledge & Perspectives
Practical thinking on regulatory oversight, governance accountability, and the evolving compliance landscape for UK financial services boards.
93% of firms believe their AI tools have improved outcomes for vulnerable customers. 35% of those same firms don't separately track whether that's actually true. Consumer Duty doesn't accept belief as evidence — and two independent pieces of work, from the Payments Association and the FCA, arrived at the same fault line within weeks of each other.
Latest Articles
93% of firms believe their AI tools have improved outcomes for vulnerable customers. 35% of those same firms don't separately track whether that's actually true. Consumer Duty doesn't accept belief as evidence — and two independent pieces of work, from the Payments Association and the FCA, arrived at the same fault line within weeks of each other.
On 13 October, the Treasury Committee got the clearest answer yet to how the FCA intends to regulate AI in financial services. It isn't a new rulebook. It's a plan to turn AI inward onto the regulator's own supervision, while telling firms that the Consumer Duty and SM&CR are the tools they will keep using. Boards waiting for bespoke AI legislation to tell them what good looks like are reading the signal backwards.
Most crypto firms are treating authorisation as a documentation project. The FCA will also be reading the application for evidence that the board understands and oversees what the firm is applying to do. Here is where that evidence is most likely to be thin, and what to ask before filing.
Andrew Bailey argues AI governance should start with rigorous testing and a genuine right to intervene — not legislation for its own sake. YouGov finds only 11% of UK consumers believe more AI will make financial firms more likely to act in their interests. Put together, they describe the same governance failure measured from opposite ends.
Parliament's Joint Committee on Human Rights says the mere presence of a human in the loop is not sufficient to constitute meaningful human involvement. New Payments Association research shows 35% of UK financial services firms don't separately monitor vulnerable-customer outcomes at all. Both are describing the same failure mode from different directions.
Davies' warning that agentic AI is generating a new generation of conduct risk in insurance deserves more board attention — not because the technology is new, but because these systems don't just score a risk or flag a recommendation. They act. And the governance structures most firms have built are not designed to catch what happens next.
The FCA's latest Consumer Duty findings suggest many boards are still treating the Duty as a compliance exercise rather than a genuine test of customer outcomes. The firms that will face scrutiny aren't the ones that failed to implement — they're the ones that implemented without understanding what they were measuring.
The NCSC's latest guidance on frontier AI and cyber threats contains a message boards should read carefully. The risk isn't just that AI makes attacks more sophisticated — it's that the governance structures most firms have built for cyber resilience weren't designed for a threat landscape that learns.
The FCA and PRA have been clear that ICAAP should be a genuine board-owned process, not a document produced by finance and signed off at the end. Most boards aren't there yet — and the gap between formal approval and genuine ownership is exactly where supervisory scrutiny lands.
The FCA's emerging AI risk framework and the Consumer Duty aren't parallel tracks — they're the same accountability question asked twice. Boards treating them as separate workstreams are building two governance structures where one integrated one would do more.
The AI Safety Institute's work on rogue model behaviour raises a governance question most boards haven't asked yet: do you actually know what AI systems are running in your firm, who authorised them, and what they're doing to customer outcomes right now?
The FCA's first Consumer Duty enforcement actions weren't about firms that ignored the rules. They were about firms that implemented without embedding — where the documentation existed but the board couldn't demonstrate it owned the outcomes. That distinction matters more than most boards realise.
A year into Consumer Duty, the FCA's own review found that many firms have the right policies but the wrong conversations at board level. The questions that should be routine — what are our actual customer outcomes, and how do we know — are still being answered with MI that wasn't designed to answer them.
Sheldon Mills' review of Consumer Duty implementation contains a message that's easy to miss if you're reading it as a compliance update. Read it as a governance document and the message is harder to ignore: the FCA is building the supervisory infrastructure to test whether board accountability is real, not just documented.
Guides & Resources
Structured frameworks and reference materials developed from advisory engagements across UK financial services firms.
A structured framework for non-executive directors to assess the quality of regulatory oversight at their firm — covering information flows, challenge culture, and accountability mapping.
Thirty questions every board should be able to answer about their firm's Consumer Duty posture. Structured by the four outcome areas with guidance on escalation triggers.
How to read, challenge, and maintain an accountability map that reflects operational reality. Includes common gaps identified in regulatory reviews and how to address them.
Governance insight is most valuable when it is applied, not archived.
If any of these perspectives raise questions about your firm's oversight arrangements, a diagnostic conversation costs nothing.
Request a Diagnostic Session