In partnership with
What I learned building payment systems at scale
I spent years at Mastercard building payment systems that had to work inside some of the most demanding privacy and data protection obligations in the industry. We handled personally identifiable information across multiple jurisdictions. We operated under GDPR before most firms had finished reading the guidance. And the lesson that shaped everything we built was simple: treat data governance as a design principle, not a compliance response.
I have been thinking about that experience a lot recently, watching how quickly FCA-regulated firms are deploying AI agents into customer-facing workflows, credit assessment, fraud detection, and personalisation. Because what I am seeing has a familiar shape. It is the same shape that preceded Cambridge Analytica.
The best prompt engineers aren't typing. They're talking.
Power users figured this out early: speaking a prompt gives you 10x more context in half the time. You include the edge cases, the examples, the tone you want — because talking is fast enough that you don't skip them.
Wispr Flow captures everything you say and turns it into clean, structured text for any AI tool. Speak messy. Get polished input. Paste into ChatGPT, Claude, Cursor, or wherever you work.
89% of messages sent with zero edits. 4x faster than typing. Works system-wide on Mac, Windows, and iPhone.
The failure that changed everything
In 2018, Meta did not fail because it built bad technology. It failed because it treated accountability as someone else's problem. Data flowed to third parties without adequate controls. Decisions were made at scale without adequate oversight. The governance structures that should have caught the risk were either absent or ignored. When the consequences arrived, they arrived fast: congressional hearings, billions in fines, and a reputational wound that took years to close.
The firms I observe today are not making the same mistake with the same technology. They are making the same mistake with different technology. And the environment they are making it in is considerably less forgiving.
Meta operated in a space where the regulatory framework was still being written. UK financial services does not have that defence. The Consumer Duty, SM&CR, and the FCA's increasingly explicit signals around AI governance form a mature accountability architecture. It was built for exactly this moment. The question is whether firms are building to meet it, or assuming their existing controls are sufficient until proven otherwise.
That assumption is the trap.
Three regulatory events. Nineteen days. One common thread.
Here is what I notice when I look across the regulatory landscape right now. The FCA chief executive used a speech this month to make the accountability obligation explicit: as AI systems move from supporting decisions to coordinating and transacting autonomously, the accountability for those regulated activities sits with named individuals. Not with the technology team. Not with the model vendor. Not with the firm in the abstract.
The Mills Review publishes on 6 July and will set the direction for AI governance in retail financial services through 2030. The BNPL regime goes live on 15 July, bringing personal accountability for AI credit decisions into legal scope for a new category of firm.
Three regulatory events in nineteen days. Each one pointing at the same structural gap.
Why SM&CR was built for exactly this moment
What strikes me about SM&CR in particular is how precisely it was designed for this moment, even though it predates the current wave of AI deployment. The regime does not ask whether your firm has an AI policy. It asks whether you, the named senior manager, can demonstrate that you took reasonable steps to understand and oversee the outcomes your firm produced.
When those outcomes are generated at scale by an AI model, reasonable steps means something specific. It means contemporaneous evidence that oversight happened, captured in real time, not reconstructed after the fact when a regulator asks. The record of what was reviewed, by whom, at what point in the decision cycle, against what documented parameters, before the decision was made. Not after harm occurred. Before.
This is the accountability gap that most firms have not yet named. They have humans in the loop. They have sign-off processes. What they do not have is the evidence infrastructure that makes those processes visible and defensible when scrutinised.
The mismatch nobody is talking about
Meta's core failure was not the breach itself. It was that the governance architecture needed to prevent or catch the breach had never been built. The firm grew faster than its accountability infrastructure. When the regulator arrived, there was nothing to show.
I am not suggesting that the CCOs and CROs reading this are negligent. I am suggesting that the speed at which AI deployment is being driven inside their firms is creating the same mismatch between innovation velocity and governance maturity that Cambridge Analytica exposed at Meta. And the consequences of that mismatch in UK regulated financial services are not corporate. They are personal.
The common thread across every regulation
The thread running through Consumer Duty, SM&CR, BNPL authorisation, and the FCA's AI governance expectations is not complexity. It is this: can you prove, with a contemporaneous record, that you acted on your accountability for these outcomes at the moment they were produced?
The firms that answer yes will not be the ones with the largest compliance teams. They will be the ones that treated evidential accountability as infrastructure, not documentation. Built in, not bolted on. Captured in real time, not assembled under pressure.
The Cambridge Analytica warning was visible before the scandal broke. The question is whether UK financial services is paying attention to the version playing out in front of it now.
Emeka Ogbonnaya is the Founder of BuildMoat, which builds pre-deployment evidential accountability infrastructure for FCA-regulated firms under SM&CR. The Accountability Record is published weekly at buildmoat.beehiiv.com
Thanks for reading
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.
