From the journal

UK FCA Applies Existing Regulatory Rules to Artificial Intelligence in Financial Services, 2024

The UK Financial Conduct Authority (FCA) published its formal approach to artificial intelligence in financial services in 2024, declaring that it would not introduce a bespoke AI-specific rulebook. The approach is operative: the FCA applies its existing Principles for Businesses, Consumer Duty, operational resilience standards, and Senior Managers and Certification Regime (SM&CR) accountability rules to AI systems deployed by regulated firms. The FCA simultaneously launched an AI Lab to

3 min read

The UK Financial Conduct Authority (FCA) published its formal approach to artificial intelligence in financial services in 2024, declaring that it would not introduce a bespoke AI-specific rulebook. The approach is operative: the FCA applies its existing Principles for Businesses, Consumer Duty, operational resilience standards, and Senior Managers and Certification Regime (SM&CR) accountability rules to AI systems deployed by regulated firms. The FCA simultaneously launched an AI Lab to support firms testing AI solutions, and a Live Testing programme for AI in real-world conditions, both of which remain active. The FCA's position represents a technology-neutral supervisory stance rather than a legislative change.

The controlling authority is the FCA Handbook, which contains the Principles for Businesses (PRIN), the Conduct of Business Sourcebook (COBS), and the Senior Management Arrangements, Systems and Controls (SYSC) module. The FCA's Consumer Duty, in force since July 2023, requires firms to deliver good outcomes to retail customers; the FCA applies that obligation equally to AI-driven decisions. The FCA has confirmed that Senior Managers under SM&CR must remain individually accountable for AI systems within their remit. No specific AI-targeted provision exists in the FCA Handbook; all obligations flow from the existing rules.

FCA-regulated firms deploying AI, including banks, insurers, asset managers, and payment service providers, must map each AI system to the relevant FCA Handbook obligations, identify the accountable Senior Manager, and document how the AI system meets Consumer Duty outcome requirements. Firms using AI in credit decisions, fraud detection, investment recommendations, and customer communications face the highest compliance scrutiny. The FCA actively monitors AI adoption through supervisory engagement, including its AI Consortium data-gathering exercise, in which over 200 firms participated. Firms with AI governance gaps risk FCA enforcement under existing powers.

The FCA stated it does not rule out introducing AI-specific rules in the future if supervisory experience reveals that existing obligations are insufficient. The FCA's Mills Review is examining the longer-term impact of AI on retail financial services. The review's final report has not been published as of the date of this analysis. The FCA also retained the right to impose AI-specific requirements on specific sectors if Consumer Duty or PRIN alone prove inadequate.

Our firm advises FCA-regulated firms on AI governance, SM&CR accountability mapping for AI systems, Consumer Duty compliance, and operational resilience requirements. We maintain a partner network with UK-based FCA compliance specialists. We invite financial institutions deploying AI in customer-facing and back-office operations to contact us for a compliance readiness assessment. We advise on: FCA AI governance frameworks, SM&CR individual accountability for AI, Consumer Duty outcome testing for AI decisions, FCA AI Lab participation, and cross-border AI regulatory divergence between the UK and EU.

Source: FCA, "AI: artificial intelligence in financial services," published 2024; available at https://www.fca.org.uk/firms/ai-financial-services; confirmed current 1 May 2026. See also FCA Handbook: Principles for Businesses (PRIN), Senior Management Arrangements, Systems and Controls (SYSC), Consumer Duty (PS22/9), and SM&CR framework.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.

AI Regulatory

More from the journal

See all
Illia Prokopiev

MLR Registration and the FCA Cryptoasset Gateway to 25 October 2027

This matter concerns the transition of a United Kingdom cryptoasset business from FCA registration under the Money Laundering Regulations 2017 to Part 4A permission under the Financial Services and Markets Act 2000. The question is whether MLR registration gives conversion, grandfathering, priority, or a right to continue after 25 October 2027, and what an affected firm should do before the gateway closes. This analysis assumes an existing UK-facing cryptoasset business, no relevant Part 4A permission, and an intention to continue after commencement.

Illia Prokopiev

Matched-Category Analysis of the Hong Kong Stablecoin Issuer Route and the Singapore Digital Payment Token Service Route

This matter concerns whether current licensing data supports a commercial comparison between Hong Kong’s stablecoin issuer route and Singapore’s digital payment token service route. The question is whether the proposition remains legally accurate as of 12 August 2026. “Commercially useful” is assumed to mean useful for selecting a market-entry and operating model, not proof that either regulator is more permissive.

Illia Prokopiev

ESMA's 2026 Custody Resilience CSA and the Rules That Actually Bind

ESMA’s 2026 Common Supervisory Action is a coordinated national review of digital operational resilience in crypto-asset custody. It will test whether selected crypto-asset service providers can demonstrate effective controls across six announced workstreams. The legal questions are which requirements are binding, how national competent authorities may assess control effectiveness, and what consequences may follow from a deficiency. This analysis assumes that the firm is permitted under MiCA Article 59 to provide custody and administration within Article 3(1)(17).