In partnership with
Two dates land this month, both put a named human on the hook for what a machine helped decide
If you work in compliance, risk or legal at a regulated firm, September has a habit of arriving with a full inbox. This year is no different. Two FCA changes land within nine days of each other, and on the surface they have nothing to do with one another.
Look a little closer and they are asking the same thing.
What is actually happening
On Monday 21 September, anyone submitting a new equity case through the FCA's Electronic Submission System, including guidance requests, has to include an inside-information declaration with the very first document. You state whether the material contains inside information and, if it does, you give details. No declaration, no case allocated for review. That is the whole rule.
Then on 30 September the FCA opens its authorisation gateway for the new cryptoasset regime. It stays open until 28 February 2027. Trading platforms, intermediaries, custodians, stablecoin issuers and firms arranging staking will all need FCA authorisation to operate once the regime comes into force, which is expected on 25 October 2027.
So the gateway opening is not the regime starting. It is the application process starting. But if you are in scope, or might be, the preparation is already urgent, because the FCA has said the framework will cover financial resilience, capital and stress testing, market integrity, insider trading and market manipulation, and it has borrowed from existing financial services standards, including the Consumer Duty, wherever the risks look similar.
There is a consultation running alongside all this too. CP26/32, the FCA's quarterly paper, includes proposals on deferral arrangements for admitting qualifying cryptoassets to UK trading platforms, plus execution-venue and execution-policy requirements for UK-authorised dealers and arrangers. Comments on those chapters close on 12 October.
Blu Dot surpasses 2,000% ROAS with self-serve CTV ads
Home furniture brand Blu Dot blew up on CTV with help from Roku Ads Manager. Here’s how:
After a test campaign reached 211,000 households and achieved 1,010% ROAS, the brand went all in to promote its annual sales event. It removed age and income constraints to expand reach and shifted budget to custom audiences and retargeting, where intent was strongest.
The results speak for themselves. As Blu Dot increased their investment by 10x, ROAS jumped to 2,308% and more page-view conversions surpassed 50,000.
“For CTV campaigns, Roku has been a top performer,” said Claire Folkestad, Paid Media Strategist, Blu Dot. “Comping to our other platforms, we have seen really strong ROAS… and highly efficient CPMs, lower than any other CTV partner we've worked with.”
Using Roku Ads Manager, the campaign moved from a pilot to a permanent performance engine for the brand.
Why a form and a gateway belong in the same story
Here is the thing that struck me about these two dates.
The declaration looks administrative. It is not. It forces a firm, an issuer, a sponsor or an adviser to reach a view on inside information before the FCA even starts reading. The judgement was always there. Market-abuse rules have defined what counts as inside information for years, and the FCA's guidance on delayed disclosure already expects issuers to identify it properly, keep it confidential while disclosure is delayed, and keep checking that the conditions for delay still hold. What changed is the moment you have to say your position out loud.
The crypto gateway does the same thing at a much bigger scale. It is not going to be handled by a policy document. It will be handled through admission assessments, surveillance, transaction monitoring, execution oversight, escalation routes, reporting, complaints, incident response and governance records. Real decisions, made by real people, day after day.
And in both cases, AI is now sitting somewhere inside the workflow.
The bit that gets uncomfortable
Nobody needs convincing that AI is useful here. There is too much data for people to read on their own. Surveillance teams are drowning in alerts. Legal teams want help pulling risks out of a 400-page diligence pack. So firms are using tools to triage alerts, spot odd trading patterns, summarise diligence, help with token admission assessments, analyse execution quality and draft communications.
None of that is a problem in itself. It often makes things better.
The problem starts when someone confuses automation with control.
A model flags a token for admission. An algorithm picks a venue. A surveillance tool scores something as low risk and it later turns out to matter. A summary drops a caveat that a lawyer would have caught. In none of those cases did the machine make the regulatory decision. The firm did. Which means the firm has to be able to answer some very ordinary questions:
Who decided the tool could be used? What was it allowed to do? What data did it rely on? Who was supposed to review the output? What triggered escalation? Who could override it? And if someone challenges the decision in a year's time, can you rebuild what happened?
Take the inside-information declaration. If a team used AI to summarise corporate records or compare documents and it surfaced nothing material, did a person independently check? If it flagged something as price sensitive, who decided whether that crossed the regulatory threshold? If it drafted the disclosure, who confirmed it was accurate and not misleading?
A tool can organise the analysis. It cannot own the judgement.
Where SM&CR comes in
This is why SM&CR matters here, and not as a threat about personal liability.
Every Senior Management Function holder has a Statement of Responsibilities. The conduct rules ask for reasonable steps to make sure the business is controlled effectively, complies with the rules, and that anything delegated is properly overseen. Nobody expects a CCO or a Chief AI Officer to personally read every AI output. That would be absurd. What they can reasonably be asked is whether they set up a credible system of governance around the AI-supported decisions that matter.
For a CCO that probably means knowing which regulated workflows use AI, how they were risk assessed, what controls apply, where escalation sits and what gets kept. For a CAIO it means a model has a defined boundary, not just a working API: approved uses, data limits, testing criteria, review points, monitoring, a fallback and a way to switch it off. For operational risk it means asking how an AI failure would show up as conduct risk, model risk, market-abuse risk, financial-crime risk or customer harm, and testing those scenarios.
And for a board, the useful question is not "what AI tools do we use?" It is "which decisions are being materially shaped by AI, and can management show who owns them, who challenges them, who monitors them and who can stop them?"
That is the difference between having an AI strategy and having an AI control environment.
The gap is not a policy gap, it is a proof gap
Most firms I talk to are not short of AI policies. They have acceptable-use guidelines, training decks, vendor questionnaires, risk principles. Plenty of paper.
The weak point is the join between that paper and the decision that got made on a Tuesday afternoon in a live workflow.
The policy says there must be human oversight. Can you show which human did it? The risk assessment says the tool is low risk. Can you show the basis, the testing and the change control behind that? The model was approved. Can you show what version was running on a given date and whether the controls still applied? Someone was "in the loop." Did they actually have the authority, the time, the information and the skill to disagree with the output?
These are not hypothetical questions. They are exactly the ones that turn up after a complaint, an execution failure, a market-abuse concern, or a letter from a supervisor. At that point a plausible story is not enough. You need to be able to reconstruct it.
What to do this month
Do not stop adopting AI. And do not slap a "human in the loop" label on every automated process and call it governed.
For each AI-assisted workflow that materially shapes a regulated outcome, build a proportionate evidence chain. A named business owner and a named control owner. A clear purpose and decision boundary. A record of which model, vendor or agent is in use. The data it touches and the permissions it has. A risk tier based on customer, market, regulatory and operational impact. Defined review, approval and escalation points. A log of exceptions, overrides and incidents. Testing and monitoring records. Review dates and change evidence. And a line back to the firm's governance structure and the relevant SM&CR responsibilities.
If you are heading for the crypto gateway, that work should feed straight into your application and readiness planning. The FCA has offered pre-application support, so use it.
If you handle equity cases, treat 21 September as a prompt to look at how inside-information assessments are made, recorded, challenged and kept, especially where AI is speeding up drafting or diligence.
The short version is this. AI is not the control. The evidence of the humans around it is.
Two different FCA dates. One direction of travel. Firms can automate the analysis, the monitoring and the drafting. They cannot automate away ownership. The firms that come out ahead will not be the ones with the most AI. They will be the ones who can explain, defend and improve the decisions AI helped them make.
Thanks for reading
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.
Until next week.
