The seven recommendations grab the headline, but the Mills Review's real teeth for anyone building an agent is the liability gap. When an autonomous agent acts on a customer's behalf and the outcome is wrong, today's rulebook doesn't cleanly say who answers for it — and the FCA is signalling it will close that gap by putting accountability on the firm that deploys the agent, not the model vendor. The build-time consequence is concrete: an auditable decision trail and a per-action human-override boundary have to exist before the rules land, because you can't retrofit provenance onto actions already taken.
The review was led by Sheldon Mills, an executive director at the FCA. Its central claim is that AI is moving past recommendation and into action. "AI will reshape consumer financial journeys, with people increasingly delegating to AI applications that act on their behalf," Mills wrote.
From advice to autonomy
For years, AI in banking mostly suggested: a better card, a cheaper loan, a nudge to save. The Mills Review argues the shift now underway is different. Agents will act inside limits a customer sets, moving savings, flagging renewals, switching accounts, without a human approving each step.
There is real appetite for it. Research commissioned by the FCA found that 20 percent of people, about 11 million UK adults, are likely to use AI that can act autonomously within pre-set goals. Context from the regulator's earlier work sharpens the picture: the Bank of England reported in 2024 that 75 percent of firms already use AI in some form, and a 2025 Lloyds survey found one in three UK customers use AI weekly to manage their money.
What the FCA is actually asking for
The Mills Review sets out seven recommendations for the FCA board. In plain terms they are: secure and adapt the regulatory perimeter so agentic tools do not fall through the cracks, strengthen system-wide coordination and oversight, monitor the transition to autonomous models, scale up the FCA AI Lab, lay the foundations for agentic finance, build an AI-enabled supervisory model so the regulator can watch machines at machine speed, and create a public-interest financial capability service.
Mills went further in comments to the Financial Times ahead of the report. He said the FCA would need greater authority to keep pace, and asked the UK government to examine whether large language models such as ChatGPT or Claude should fall under financial rules when they are used inside financial services. He framed the challenge bluntly, calling the effort to keep up an "arms race."
The risks the regulator named
The review does not pretend the upside is free. It flags bias in automated decisions, opaque pricing that a consumer cannot interrogate, and personalized manipulation at scale. The speed is part of the risk: the FCA notes that loan underwriting could compress from weeks to minutes, and insurance claims from months to hours. Faster is only better if a person can still understand the outcome and challenge it.
Notably, the FCA is not promising to remove human intermediaries. Its own framing is that AI will relocate intermediation rather than delete it, and that the shape of retail finance could look materially different by 2030.
What this means for banks and fintechs
Read past the policy language and the Mills Review is close to a build spec. If autonomous agents are the destination, then accountability, transparency, and consumer control are the load-bearing walls, not decoration. At PATech we build voice and workflow agents for exactly this kind of regulated setting, so the practical reading is straightforward.
Three things move from nice-to-have to non-negotiable. First, an audit trail: every action an agent takes on a customer's behalf needs a timestamped, human-readable record of what it did and why. Second, a real off-ramp: a customer, or a compliance officer, must be able to pause or reverse an agent inside its set limits, not after the money has moved. Third, explainability at the point of action, not buried in a policy PDF. Teams that bake these in from the first sprint will ship into the new rules. Teams that bolt them on later will rebuild.
The bottom line
The Mills Review is a signal, not a rulebook, and the hard decisions on new powers now sit with the UK government. But the direction is set. Agentic finance is coming, the regulator wants to supervise it at the pace it actually runs, and the firms that treat control and auditability as core product, not compliance overhead, will be the ones customers and regulators trust with the keys.