Sponsored by
Hello {{first_name | Reader}},
AI, regulation, risk and compliance are moving fast. Faster, in many cases, than the horizon-scanning processes designed to keep up with them.
We've been inundated this week with updates from regulators, financial institutions, technology providers and compliance leaders. We've cut through the noise to pull out the signals that actually matter.
This is your weekly view of what's changing, why it matters, and what you should be doing about it.
No 50-page horizon scan. No regulatory news dump.
Just the signals worth your attention.
Let's go.
In 30 seconds
🔴 AI accountability: The FCA has shown what good practice looks like. Check that every live AI use case has a named senior manager, documented oversight and an evidence trail. Likely owners: the SMF holder for the business area, with the CRO (SMF4) for the framework.
🟡 AML risk: American Express was fined $350m after its risk assessment underweighted its largest business. Your risk assessment should follow where volume and exposure sit, not how your products are organised. Likely owner: the MLRO (SMF17) and the board.
🟡 Motor finance: The redress challenges will be heard from 16 to 26 February 2027. Lenders should already know who owns the contingency plan if the scheme is quashed.
The theme: Regulators are interested in the gap between what your framework says should happen and what you can prove actually happened.
State of Product reveals what AI still hasn’t solved
80% of product professionals say AI helps them ship faster, but customers aren’t seeing value any sooner. Atlassian’s State of Product 2027 explores the gains AI is delivering and the challenges that remain, from decision-making that hasn’t kept pace to gut instinct overriding customer evidence.
The Lead
The FCA has moved AI governance from principles to evidence
🔴 If your firm has AI in live use, this is worth your attention.
The FCA's AI in financial services: good practice and areas for improvement (19 October) introduces no new rules, and the FCA says its examples create no new requirements. That is not the point. It tells you what supervisors are likely to ask for when they walk through an AI use case.
It draws on a year of FCA testing: AI Live Testing, the Supercharged Sandbox, the AI Input Zone and the Mills Review. The message is consistent: it isn't enough to have an AI policy. You need to show how it operated in practice.
What a supervisor should be able to establish
Who is accountable? A named senior manager, with a clear technical owner, assigned at design.
What was authorised? The boundaries and intended use of the system.
What happened? A record of decisions, oversight, challenge and escalation.
What happens when it goes wrong? An incident playbook, approved by the SMF before go-live, with thresholds for intervention or shutdown.
What can it reach? A central inventory of agents, systems, data and controls.
Where did humans intervene? Evidence that an output was approved, challenged, overridden or escalated.
"We have a human in the loop" is a weak answer now. The better question is: what did the human actually do?
If you already run model risk, much of this is familiar
A bank with a mature model risk function (PRA SS1/23 for banks, SR 11-7 in the US) already has inventories, ownership, validation, tiering and audit trails. Credit where it is due: that is the foundation, and it is the right place to start.
Where the FCA's examples go further:
Accountability to a person, not a function. Model risk assigns a model owner. The FCA links the use case to a named SMF and expects documented reasonable steps. That is the SM&CR layer over model risk, and many firms have not built it.
Models that change underneath you. Classic validation assumes a bounded model with stable behaviour. A third-party GenAI model changes when the vendor updates it, so a point-in-time validation ages quickly. The FCA's language on "continuous, conditional assurance" addresses this.
Systems that act. A traditional model produces an output. An agent can call another system, retrieve information, trigger a workflow or message a customer. Assurance has to follow the action, not just the model.
Firms with no model risk function. Many asset managers, insurers, payments firms and smaller advisers use AI without one.
There is a useful history here. Firms moved from models, to end user computing tools, to agents. Agents inherit the unresolved EUC problems: incomplete inventories, unclear ownership, weak change control, and tools built by business users that nobody in risk has seen. If your EUC register was never complete, your agent register will not be either.
Where firms are struggling
Technical teams own the implementation. Business teams own the outcome. Risk owns the framework. Somewhere between them, accountability blurs. The result is an audit trail that proves a governance meeting happened, but cannot show why a particular decision was made.
The FCA also flagged vendor assurances accepted untested and reliance on a single provider with no exit plan.
Your five-minute test
Pick your most material live AI use case. Could you reconstruct its last significant decision for a supervisor tomorrow?
Who authorised the use case?
What was the system allowed to do?
What did it actually do?
What human intervention occurred?
Where is the evidence?
If answering requires information from five different teams, your governance is not operating as one control system.
Takeaway: The FCA is not asking senior managers to become AI engineers. It is asking for reasonable steps, challenge, oversight and accountability, and the evidence of those steps matters as much as the policy.
The joint FCA and Bank of England AI survey publishes next week and will give you a benchmark. The FCA also says supervision itself is being automated, so expect it to get faster and more data-driven, not lighter.
Good and poor practice · Speech
The Radar
🔴 Motor finance: plan for both outcomes
The Upper Tribunal hears challenges to the redress scheme from 16 to 26 February 2027. The scheme is partly suspended and lenders need not yet calculate or pay compensation. The FCA expects firms to plan for the scheme being quashed, including provisions and talks with auditors.
Do now: Name the executive owner of the contingency plan and agree what triggers action. FCA
🟡 High LTI lending: responsibility moves to the firm
PS19/26 takes effect on 28 October. The firm-level 15% flow limit goes, and firms set their own strategy while staying consistent with the FPC's aggregate 15% limit, measured over four quarters.
Do now: Document your high LTI risk appetite and make the accountable owner explicit. Regulation Tomorrow
🟡 CFD firms: fair value cannot become a tick-box
Only 12% of firms changed their charges after the FCA's review. The concern is whether fair value assessments actually show customers receive value. Overnight funding on hedged positions is a named issue.
Do now: Re-test your fair value assessment as if the FCA were reviewing it tomorrow. FCA
🟡 Safeguarding: check where customer money sits
ePayments Systems Limited and Jarvis Investment Management entered special administration on 15 October. The FSCS does not cover payment services funds.
Do now: If you hold money with an e-money provider, verify the safeguarding arrangements rather than relying on the provider's description. FCA
Quiet week for the PRA and Bank of England: no new supervisory statement.
Financial Crime
Three US fines. One recurring lesson.
No new FCA fines this month (the latest is Robin Odey, £1.53m, 30 September). Three US cases offer reminders, and the failures are the ones UK supervisors test.
$350m: American Express (OCC, 8 October)
About $13bn of suspected trade-based money laundering went unreported over a decade. The risk assessment focused on deposit products and underweighted the much larger card business. Testing and training were also weak.
The lesson for the MLRO and the board: the risk assessment has to follow the actual risk. Are you allocating financial crime resource by where exposure is greatest, or by how your organisation happens to be structured? And does independent testing cover the biggest lines?
About $1.2bn: Bank of America (13 October)
FinCEN, the OCC ($750m, its largest ever) and OFAC (an $11.6m sanctions settlement). The bank says the penalties stem from a 2024 consent order.
The question: can you evidence that every open remediation commitment has an accountable owner and measurable progress? A consent order is not a finish line.
$33m: SEB (NYDFS, 15 October)
Weak due diligence on high-risk correspondent banks and Baltic transaction monitoring, 2015 to 2019. The DOJ closed its investigation without a penalty.
The test: pull your oldest high-risk correspondent files and run a look-back. Would they survive today's standards?
Closer to home
On 13 October the FCA and NCA arrested three people in a joint operation over suspected insider dealing and money laundering. No charges yet. Do your market abuse and AML teams know how an alert moves between them? If it depends on someone knowing who to call, that is a process risk.
Dates: the plan to double the maximum OFSI penalty is still pending, and OFSI general licence INT/2025/7895596 expires 29 October. Confirm you are not relying on it.
OCC release · Bank of America · SEB · Arrests
Stop typing AI prompts. Start talking.
You think 4x faster than you type. So why are you typing prompts? Wispr Flow turns your voice into ready-to-paste text inside any AI tool. Speak naturally, tangents and all, and Flow cleans it up. Available on Mac, Windows, iPhone, and Android.
Cyber & Resilience
AI capability is moving faster than assurance
The FCA's frontier AI and cyber resilience review (2 September) found that readiness, not model capability, is the constraint. Firms discover vulnerabilities faster than they can validate and fix them. That is a familiar operational resilience problem: the technology moves faster than the control environment.
The board question is not "are we using frontier AI?" It is "can our control environment keep pace with how quickly it is deployed and changed?" That gets uncomfortable when a third-party model or cloud provider changes underneath you.
There is also a structural gap. The Bank of England's April letter to the Treasury Committee makes AI a 2026 PRA priority but commits to no designation of AI or cloud providers as critical third parties by year end. Until then, oversight of those suppliers sits with your firm.
Do now: For your most important AI supplier, identify who owns the decision to pause, replace or exit it. The Cyber Security and Resilience Bill reaches report stage on 26 October.
RegTech Watch
The compliance stack is consolidating
Behavox buys Apiax (16 October, terms undisclosed). It combines regulatory change management, machine-applicable rules (including cross-border) and an AI policy assistant. The direction of travel is a connected evidence chain: regulatory change, policy, control, decision, monitoring, evidence. That is a different proposition from another document repository.
Consolidation creates a question for risk leaders: what happens if the platform becomes critical to your control environment? If a compliance control depends on one provider, its resilience and exit terms are part of your control framework.
Do now: For any RegTech vendor becoming embedded in a critical process, test your exit assumptions before you need them. FinTech Futures
BuildMoat Spotlight
From governance documents to evidence of control
You can have a policy, an approving senior manager, a risk assessment, a governance committee and a sign-off pack, and still struggle to answer: what did the system actually do at 14:37 on Tuesday, under whose authority, and who intervened?
BuildMoat is designed around that problem. It records what an AI system is authorised to do, monitors its actions against that boundary, and creates an evidence trail around intervention and accountability. It is meant to extend existing model risk and SM&CR controls to agents, not replace them. The aim is a control environment closer to the thing being controlled.
Learn more: buildmoat.co.uk
The SM&CR Question
Would your AI governance survive a supervisor's questions?
The AI publication and the CFD review share a theme: they push back on compliance activity that exists mainly to demonstrate compliance. Section 3.3 of the AI publication sets out reasonable steps for senior managers: ownership assigned at design, targeted training, documented and auditable oversight, and threshold-based escalation.
A human review that is a click on "approve" is not oversight. A risk assessment not updated when the business changes is not risk management. A committee that cannot explain a material decision is not accountability.
The question for the senior manager: can you demonstrate the judgement behind the control, not just that the control existed?
This Week's Executive Checklist
Before your next risk or compliance committee, ask:
AI: Can we reconstruct a material AI decision from start to finish?
Accountability: Does every material AI use case have a named senior manager, assigned before go-live?
Authority: Are the boundaries of what an AI system can do explicit and enforceable?
Evidence: Does our audit trail show what actually happened, not just that a control existed?
Inventory: Does our model risk inventory include third-party GenAI and agents, or only the models we built?
Resilience: Could we pause, replace or exit a critical AI or RegTech provider without losing control of the process?
If you cannot answer one of them, that is the item for the agenda.
Calendar
Week of 26 October | FCA and Bank of England AI survey publishes
26 October | Cyber Security and Resilience Bill report stage
28 October | PS19/26 high LTI rules take effect
29 October | OFSI general licence INT/2025/7895596 expires
6 November | CP26/34 transaction reporting consultation closes
Q1 2027 | FCA AI Live Testing evaluation report expected
16 to 26 February 2027 | Upper Tribunal hears motor finance challenges
One Thing to Read
Section 3.3 of the FCA's AI good and poor practice publication, on senior manager reasonable steps and the related case studies. Take your most important AI use case and score it against the examples. Would the evidence in your systems convince a supervisor that the control actually operated?
Pulse Check
Could your firm reconstruct a material AI decision from authorisation to execution?
Results shared next week.
Thanks for reading
The Adoption Gap is published by BuildMoat. Regulatory commentary in this newsletter is for informational purposes only and does not constitute legal, compliance, or financial advice. Readers should consult qualified professionals for advice specific to their firm. Product mentions, including BuildMoat's own, reflect the editorial team's assessment and are clearly disclosed where a conflict of interest exists.
Sign-off. The Adoption Gap is written for compliance leads, MLROs, CROs, and risk directors who need practical intelligence delivered without the jargon tax. Reply with a tip, a correction, or a story. Forward it to a colleague who needs it. Until next week.
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
Until next week.
