The FCA's Mills Review requests direct statutory authority over AI vendors and cloud providers in UK retail banking, and proposes an FCA built AI supervisory model to monitor firms and markets in real time.
Britain's Financial Conduct Authority is asking ministers for direct statutory power over the AI systems and cloud providers that supply retail banking, in a review that puts the regulator on a much more hands-on footing than its recent industry-engagement stance allowed.
The Mills Review, published on Monday and led by the FCA's executive director Sheldon Mills, gives ministers a menu of new tools. They include direct statutory authority over "critical third parties", the AI vendors and cloud suppliers that the largest banks now rely on to run customer-facing services, and a new FCA-owned AI supervisory model that would watch firms and markets in real time. The FCA has also asked government to consider broader competition powers over digital monopolies in retail finance.
The primary review document sets a horizon of roughly 2030, by which point the FCA expects AI-enabled services to dominate a meaningful slice of retail financial advice, fraud detection and credit decisions. The FCA's own survey, cited in the review, finds about 11 million UK adults are open to letting AI help with savings and borrowing decisions. The same document warns that without new oversight the shift amplifies fraud, cyber risk, consumer harm and market concentration.
The Guardian's summary framed the review as a request to "boost" the FCA's powers, which understates the institutional shift on offer. For several years, the FCA's posture has been iterative industry engagement: guidance, feedback statements, sandboxes, rather than prescriptive rules over the suppliers themselves. Asking for direct authority over AI vendors and cloud providers is a structural change in tone, even though adoption sits with the Treasury rather than the FCA.
The adoption question is the political front. Neither the FCA nor Mills can impose the new regime unilaterally; ministers have to legislate, and the FCA's own blog on AI in financial services still leans on cooperation. If Treasury slows the request, the FCA may have to lean harder on the AI supervisory model it is building internally. That would, by the regulator's own logic, make the model the operational backbone of any new regime.
In the same week, HSBC, Lloyds and NatWest moved to build the UK's first "sovereign" AI model for financial services, a model stack trained on domestic banking data and intended to underpin consumer-facing tools. The FCA's ask is to supervise the firms building and selling that kind of stack, and to build its own model to watch them.
Independent academic framing from Loughborough, reported through The Conversation, is more cautious than the sector's marketing. AI banking can plausibly widen access for lower-income customers, the analysis argues, but only where trust, transparency and complaint-handling are first-class features, not by default.
Three early signals will show whether the shift holds: the Treasury's formal response to the review's statutory asks, published milestones for the FCA's own AI supervisory model, and how the banks' sovereign-model consortium handles regulator access. The review is dated July 2026; the legislative clock has not yet started.