FCA Mills Review maps how AI will reshape retail finance by 2030

The Financial Conduct Authority has published the Mills Review, the first regulator-initiated study of its kind globally, concluding that AI is on course to become a defining force in retail financial services and setting out a seven-point roadmap for how the regulator, industry and government should prepare. Released on 6 July 2026 and led by FCA executive director Sheldon Mills, the review examines how AI could restructure the sector for consumers, firms, markets and regulators by 2030 and beyond, and lands with a clear signal: no new AI-specific rulebook, but a materially higher bar on governance, oversight and evidence.

For finance professionals, the takeaway is less about fresh regulation and more about the direction of travel. The review confirms the FCA will keep leaning on its existing principles-based framework, anchored by the Consumer Duty and the Senior Managers Regime, rather than writing bespoke AI rules. What changes is the intensity of scrutiny applied to how firms deploy the technology.

What did the Mills Review actually find?

The report identifies four AI-driven shifts likely to reshape retail financial services: the transformation of firm operations, the evolution of consumer journeys, the reshaping of competition and market power, and the amplification of fraud and cyber risk. That framing matters because it treats AI not as a single risk to be contained but as a structural force acting on multiple parts of the market at once.

The consumer appetite data is the review's most quotable finding. Research commissioned by the FCA and conducted in April 2026 by Yonder Consulting, surveying more than 5,000 UK retail financial services consumers, found that 20% of people, equivalent to roughly 11 million UK adults, would be likely to use AI capable of acting autonomously within pre-set goals. Demand was strongest for debt advice, pensions and investments. The same body of research indicated that around 26% would trust general-purpose tools such as ChatGPT, Claude or Gemini for financial advice, frequently without understanding that formal routes to redress would not apply. Trust and control emerged as the dominant consumer concerns.

This sits against a backdrop the review makes explicit: more than 75% of UK financial services firms already use AI in some form, from credit decisioning and fraud detection to underwriting and chatbots. The question the Mills Review poses is not whether AI arrives, but what happens as systems move from recommending to acting.

What are the seven recommendations for the FCA?

The review sets out seven recommendations for the FCA Board and Executive to weigh. In summary, they are: secure and adapt the regulatory perimeter; strengthen system-wide coordination and oversight; monitor the transition to autonomous models and adapt frameworks accordingly; scale up the FCA's AI Lab; enable the foundations for agentic finance; build and adopt an AI-enabled agentic supervisory model; and develop a trusted public-interest AI-enabled financial capability service.

Two of these carry particular weight for the industry. The perimeter recommendation confronts a structural tension: if consumers increasingly rely on AI systems supplied by a small number of large technology companies to make financial decisions, those companies may exert influence comparable to regulated firms without carrying equivalent obligations. The review notes the Critical Third Parties regime is technology-agnostic and could capture major AI and cloud providers where designation criteria are met, and its longer-term recommendation asks the FCA to press government to strengthen powers under both the CTP regime and the Digital Markets, Competition and Consumers Act.

The seventh recommendation is the most consumer-facing. It proposes a free, publicly accessible AI-enabled financial capability service, developed with HM Treasury, the Money and Pensions Service, consumer bodies and industry, so that access to high-quality financial support does not depend on the ability to pay for premium AI tools.

Why the governance bar is rising across the wider market

Although the review is scoped to retail financial services, its central message about data quality and accountability extends well beyond that segment. Paul Templar, CEO of delegated authority technology provider VIPR, argues that the same regulatory expectations are already surfacing in specialty and delegated markets.

"Although the FCA's review focuses on retail financial services, its message is relevant well beyond that part of the market. AI is only as good as the data behind it. As it moves quickly from experiment to core business infrastructure, regulators are increasingly focused on the controls, governance and accountability that underpin its use," Templar said.

He points to delegated authority as an early test case. "The market is growing, capital continues to flow in, and AI-led initiatives are accelerating, but the same question keeps coming back: can firms demonstrate robust oversight and evidence what is happening across the delegated authority chain?" Templar added that clean, structured and auditable data is becoming a precondition rather than an operational nicety: "AI raises the prize, but it also raises the bar. Clean, structured and auditable delegated authority data is no longer simply an operational improvement. It is becoming the foundation for trusted AI, effective governance and regulatory confidence."

The review builds on the FCA's prior work, including its AI Discussion Paper, AI Sprint and AI Lab, the last of which includes a Supercharged Sandbox supported by NVIDIA. Running in parallel, the FCA will publish an AI good and poor practice document later this year, drawn from direct engagement with firms.

Why This Matters to FinanceX Readers

The Mills Review reframes the UK's AI supervisory posture from a compliance question into a competitive one. The FCA has confirmed it will not build a separate AI rulebook, which removes a source of uncertainty for firms planning multi-year technology investment. But the trade-off is a sharper evidence burden: continuous monitoring displacing periodic review, testing that extends beyond deployment, and controls that flag when systems drift outside expected bounds.

Firms that can already evidence auditable decision logic and clean data pipelines will move faster and carry less regulatory risk than those retrofitting oversight after the fact. The perimeter debate is the one to watch, because how the FCA treats large AI and cloud providers will shape competitive dynamics across advice, distribution and infrastructure for the rest of the decade.