In partnership with
Hi there,
Last week brought an unexpected heatwave to the UK. At the FCA, things were heating up too.
Over the past few weeks, I've had a lot of conversations with RegTech founders and compliance leaders. One theme keeps coming up: evidence.
The FCA is sending a clear message. When it comes to AI, governance, and decision-making, it's no longer enough to have policies, frameworks, or good intentions. Firms need to show what they've actually done.
That creates a challenge. As AI becomes more embedded in decision-making and governance moves higher up the board agenda, how do you make that evidence accessible and defensible?
In this edition, I cover two developments that point in the same direction. The FCA is moving beyond explanations and focusing on proof.
Before that, we've relaunched our website. It reflects how we think about accountability infrastructure and what it takes to operationalise accountability across financial services.
If this newsletter was forwarded to you, you can subscribe for weekly insights on what regulators are saying and what it means in practice for AI governance and accountability.
Let's get into it.
Your prompts are leaving out 80% of what you're thinking.
When you type a prompt, you summarize. When you speak one, you explain. Wispr Flow captures your full reasoning — constraints, edge cases, examples, tone — and turns it into clean, structured text you paste into ChatGPT, Claude, or any AI tool. The difference shows up immediately. More context in, fewer follow-ups out.
89% of messages sent with zero edits. Used by teams at OpenAI, Vercel, and Clay. Try Wispr Flow free — works on Mac, Windows, and iPhone.
What's moving this week
The FCA's AI Input Zone: From Principles to Proof
On 22 May, the FCA reopened its AI Input Zone, collecting specific examples of good and poor AI practice across banking, insurance and markets, ahead of a publication the regulator expects to set the de facto UK standard for AI assurance in financial services. The submission window closes 19 June 2026. Colin Payne, the FCA's head of innovation, framed the ask directly: "Not theory. Evidence." The regulator wants specific examples spanning governance, resilience, oversight, assurance, deployment controls and consumer outcomes, not principles or policy statements. The move comes as the FCA simultaneously expands its AI Live Testing programme, which now includes Barclays, UBS, Lloyds Banking Group and Experian working in a supervised real-world testing environment with technical partner Advai.
This matters because it changes the definition of compliance. The FCA has explicitly set out the testing perimeter as the full system: the model itself, the deployment context, the governance arrangements, the human-in-the-loop controls, evaluation techniques, and input and output controls. Banks, insurers, and fintechs that have built AI governance around policy documents and board-approved frameworks are being asked to evidence what actually happens when those systems operate in production. The contrast with the EU is deliberate. The EU AI Act omnibus, agreed on 7 May, pushed high-risk compliance deadlines to December 2027. The FCA is moving the other way, pulling enforcement-grade evidence into supervisory dialogue now.
The AI governance implication is direct. Under SM&CR, the Senior Managers and Certification Regime, named senior managers are personally accountable for the material risks in their business areas. If your Chief Risk Officer or Head of AI has signed off on an AI deployment, the FCA is asking whether they can evidence how that deployment was governed, tested, and monitored while it was live. A policy framework is not evidence. An approved implementation plan is not evidence. Documented assurance artefacts from live deployments, with named ownership and dated review records, are what the FCA is asking to see. Firms with that evidence ready by 19 June 2026 will have first-mover positioning when the FCA's good-and-poor-practice publication lands later this year.
Financial Promotions: Third-Party Templates Are Not Governance
On 27 May, the FCA published findings from its review of 10 authorised firms that approve financial promotions for businesses without FCA authorisation, covering BNPL providers, crowdfunding platforms, and corporate finance firms. Section 21 approvers are firms with explicit FCA permission to sign off on promotions so that products can be legally marketed to UK consumers. The FCA found that the strongest firms embedded Consumer Duty checks from the beginning of their processes, ensuring every promotion was accurate, clear, and reached the right audience. Some firms approved adverts with unsubstantiated claims. Some allowed retail investors to see promotions intended for professional clients. Some relied on third-party templates instead of conducting their own checks. One firm has been required to conduct a remediation exercise. Some websites have been blocked to retail customers. Lucy Castledine, the FCA's director of consumer investments, said: "When approvers fail in their responsibilities, people can be misled into harmful financial decisions."
The firms directly affected are Section 21 approvers. But the implications extend to any firm that has built its compliance workflow around a bought-in tool or an outsourced review function. Consumer Duty, the FCA's framework holding named senior managers accountable for delivering good customer outcomes, is the operating standard. The FCA found that the weakest firms in this review were those that had delegated the substance of the compliance check to a template or a third party while retaining the name on the approval. That is the structure of accountability without the content of accountability.
The AI governance implication is underappreciated. Many Section 21 approvers, and many more compliance teams across the industry, are using AI tools including large language models and automated scanning platforms to review documents for compliance issues before sign-off. The FCA's findings do not name AI tools. But the failure pattern they describe is structurally identical to what happens when a firm treats an AI review tool as the accountable party rather than as one component in a governed human process. Relying on a third-party template to approve a financial promotion is the same structural failure as relying on a third-party AI model to identify a compliance issue without documented human oversight and a named accountable individual. The person holding the Section 21 permission is accountable. The tool is not.
7 Stocks to Ride The A.I. Megaboom
The next A.I. boom could create massive winners just like the 1990s tech surge.
We identified 7 small tech companies positioned to benefit from the next phase of A.I. growth.
See them inside this free report 7 Stocks to Ride The A.I. Megaboom.
The BuildMoat angle
This week gives us two versions of the same problem in different parts of the market. In the AI Input Zone story, the FCA has moved the supervisory bar from intention to evidence. In the financial promotions story, the FCA found firms that met the letter of their approval obligation while losing the substance of it to templates and outsourced tools. Both failures come from the same place. AI adoption in regulated environments has moved faster than the human infrastructure needed to be accountable for it. The question the FCA is asking firms to answer, whether in an AI Input Zone submission or in a financial promotions review, is not what process you ran. It is who was responsible, what did they check, and what evidence exists that they exercised that responsibility in the way the regulator expects. Those are not questions a system can answer. They are questions that require named people, documented oversight, and a clear accountability chain that connects the AI output to a human decision.
One question to take into next week
If the FCA requested evidence today, not policy, of how your most material AI deployment was governed in the last 90 days, what would you hand over and who would you point to as the named accountable individual?
If this is a live problem in your organisation, reply to this email. BuildMoat works with UK financial services firms to build the human infrastructure that closes the gap between AI deployment and regulatory accountability.
BuildMoat — buildmoat.co.uk
Thanks for reading
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.
Until next week.
