Artificial Intelligence (“AI”) is transforming financial services, creating opportunities to improve efficiency, enhance customer experiences and strengthen fraud detection. However, its growing use also raises important questions about consumer protection, governance, accountability and operational resilience.
In its speech “Building the future of finance in the age of AI” the Financial Conduct Authority (“FCA”) sets out its vision for the safe and responsible adoption of AI across financial services. The FCA recognises AI’s potential while emphasising that firms must maintain effective oversight, protect consumers and ensure that innovation does not compromise regulatory standards.
For regulated firms, the priority is to ensure that AI adoption is supported by appropriate governance, proportionate controls and a clear focus on consumer outcomes.
Understanding the FCA’s Approach to AI
The FCA recognises that AI can improve productivity, accessibility, decision-making and financial crime detection. However, inaccurate outputs, algorithmic bias, cyber vulnerabilities and excessive reliance on automated systems can create significant risks, particularly when AI operates at scale.
The FCA also highlights the increasing adoption of AI across financial services, alongside the emergence of agentic AI (systems capable of undertaking tasks and executing actions with increasing autonomy). These developments raise additional questions about accountability, delegated authority and the ability to monitor and control automated decisions.
Moreover, the FCA draws attention to consumers relying on general-purpose AI tools for financial information and investment guidance, highlighting the importance of clear communication about the limitations of these tools and the distinction between regulated financial advice and general information.
The FCA’s message is not intended to discourage innovation, but to ensure that firms adopt AI responsibly, maintaining consumer trust and effective risk management.
Strengthening AI Governance and Consumer Protection
The FCA’s observations highlight three key areas firms should consider when reviewing their AI arrangements.
- Consumer Outcomes and the Consumer Duty
AI should address a clearly defined consumer need and support fair outcomes. Firms should assess whether AI-enabled products and services are appropriate for their target markets, including vulnerable customers and whether customers can access human support when necessary.
Where the Consumer Duty applies, firms must also consider the relevant requirements under PRIN 2A of the FCA Handbook, including those relating to consumer understanding, consumer support and the needs of vulnerable customers.
Based on the above, firms should consider:
-
- Fairness and accuracy: Testing AI outputs for reliability, bias and unintended consequences.
- Consumer understanding: Explaining how AI is used and providing appropriate access to human assistance.
- Vulnerable customers: Ensuring AI-enabled journeys do not create unnecessary barriers or disadvantage particular groups.
- Ongoing monitoring: Reviewing real-world outcomes and addressing issues promptly.
- Governance, Accountability and Human Oversight
Effective AI governance requires clear responsibilities, appropriate controls and meaningful human oversight. Firms remain accountable for their use of AI, including systems provided by external suppliers.
Firms should assess whether:
-
- Governance frameworks: AI risks are assessed throughout the system lifecycle, from design and testing to deployment and ongoing monitoring.
- Senior management accountability: Responsibilities for AI-related risks are clearly allocated, with appropriate oversight and challenge.
- Human oversight: Staff understand when AI-generated decisions should be reviewed, overridden or escalated.
- Documentation and assurance: Firms maintain sufficient records to investigate issues and demonstrate how risks are managed.
Governance arrangements should be proportionate to the firm’s activities and the potential impact of each AI use case.
- Operational Resilience, Cyber Security and Third-Party Risk
AI systems can improve productivity and performance; however, they may also introduce new operational dependencies and vulnerabilities. Firms should understand how failures, inaccurate outputs or supplier disruption could affect their services and customers.
Some key considerations include:
-
- Scenario testing: Testing AI systems against unexpected outputs, cyber incidents and operational failures.
- Business continuity: Maintaining fallback arrangements where AI systems become unavailable or unreliable.
- Third-party risk: Assessing supplier dependencies, concentration risks, contractual arrangements and ongoing oversight.
- Incident management: Establishing processes to identify, escalate and investigate significant AI-related incidents.
- Continuous monitoring: Reassessing systems as models, performance and operating environments change.
These considerations are particularly relevant where AI supports payments, customer services, trading, fraud detection or other activities essential to business operations (where failures could have a detrimental impact on customers or the firm’s operations).
Preparing for the Future of AI in Finance
The FCA also focuses on the development of agentic finance, where AI agents may search for financial products, manage payments or investments and transact with other systems.
Although these developments may improve efficiency and accessibility, firms will need to consider how AI agents are authenticated, what actions they are authorised to perform, how delegated authority is restricted and who remains accountable when something goes wrong.
The FCA intends to work with industry and other stakeholders to support a trusted environment for these developments. Meanwhile, existing regulatory obligations continue to apply to firms’ use of AI, including relevant requirements concerning consumer protection, senior management accountability, systems and controls, operational resilience and outsourcing.
Looking Ahead
The FCA’s message expressed is that successful AI adoption must combine innovation with effective governance, risk management and consumer protection.
For compliance and risk teams, the priority is to review existing AI use cases, assess potential gaps in governance, test consumer outcomes, clarify accountability and strengthen operational resilience. Additionally, AI governance should be an ongoing process that adapts as technology and associated risks evolve.
How Complyport Can Help
Complyport supports financial services firms in strengthening their governance, risk management and regulatory compliance arrangements. Relevant services include:
- Regulatory Compliance Reviews: Identifying potential gaps against applicable FCA requirements and recommending improvements.
- Governance and SMCR Support: Reviewing senior management responsibilities, accountability and oversight arrangements.
- Operational Resilience Reviews: Assessing important business services, scenario testing and contingency arrangements.
- Outsourcing and Third-Party Risk Management: Reviewing supplier due diligence, contractual arrangements and technology dependencies.
- Risk Management and Compliance Frameworks: Supporting firms in assessing emerging risks and strengthening policies, procedures and controls.
These services can help firms assess whether their existing arrangements remain appropriate and develop a proportionate approach to responsible AI adoption.
Book a Meeting with a Complyport SME
To explore the implications of AI developments for your firm’s governance, operational resilience and regulatory compliance, get in touch with Complyport to arrange a consultation with one of our Subject Matter Experts.
Ask ViCA, your Virtual Compliance Assistant
Access instant answers on regulatory changes.
Discover how Complyport can support your compliance needs. Visit https://complyport.tech/ to learn more about our RegTech solutions.
