The FCA Just Put AI Accountability on a Deadline. Most UK Financial Services Firms Are Not Ready.

In the next nineteen days, two separate regulatory events land simultaneously. One is a hard deadline with a fine regime attached. The other is a strategic signal that will set the direction for AI governance for the next four years. If you treat these as disconnected, you are taking a position you may not be able to defend. And before either of those events arrives, the FCA chief executive Nikhil Rathi used a speech this week to tell the market exactly where regulation is heading. I have done a full deep dive on that speech and what it means for you in a separate article, which you can read here. The short version: the FCA is not waiting for legislation. It is already moving. And accountability for AI outcomes, tied to you by name, is the direction it is moving in.

Catch is an AI agent focused solely on administrative tasks. We don’t write code, create images, or analyze data. Our single mission is to build the most advanced agent you can trust to delegate your daily workload, expertly handling scheduling, reminders, email, and travel logistics.

Genuinely proactive, Catch operates with the initiative of a human employee. It is available wherever you already are, working seamlessly over the phone, WhatsApp, and iMessage to keep your day moving forward. Because true delegation requires absolute peace of mind, Catch is built on highly secured infrastructure and is fully SOC 2 compliant, ensuring your data is always protected.

Test Catch today to see how it handles the friction in your workflow.

Set up Catch today!

Nikhil Rathi Sets the Tone: Accountability Is Not a Technology Question

Before the Mills Review publishes and before the BNPL deadline lands, the FCA chief executive used this week's techUK Agents of Change conference to make the FCA's position explicit. Speaking on 24 June 2026, Rathi said that as AI systems move from supporting financial decisions to coordinating and transacting autonomously, accountability for regulated activities and outcomes must remain clear. He was direct about who that accountability sits with: agentic AI must be designed with the right human oversight, in a way that gives consumers confidence to engage. That oversight obligation is yours. Not your firm's AI team. Yours.

He also confirmed that the FCA intends to use its system-wide competition and resilience powers more frequently as AI reshapes markets, and that traditional rule-making alone will not keep pace with the technology. The FCA's role, in Rathi's framing, is increasingly one of stewardship alongside supervision. That is a significant reframe. It means the regulator is not only watching what your firm builds. It expects to be involved in how you govern what you build. I have written a full analysis of the speech and its implications for SM&CR firms here: The FCA Just Cleared the Runway. It Didn't Take the Controls.

The Mills Review: The FCA Sets a Publication Date and a Direction

The FCA confirmed this week that the findings from the Mills Review will be published on 6 July 2026. The Review, led by Executive Director Sheldon Mills and launched in January 2026, was commissioned to examine how AI will transform retail financial services by 2030 and beyond. Its specific brief was to assess whether the FCA's existing regulatory frameworks, the Consumer Duty, SM&CR, and operational resilience requirements, are adequate for an AI-enabled market. A publication date confirmation is not a minor administrative update. It is the FCA signalling that its conclusions are final and that it is ready to go on record.

If your firm uses AI in retail financial services, these findings apply to you. Credit decisions, pricing models, robo-advice, automated affordability assessments, all of it is within scope. The central question the FCA is answering is not whether AI is useful. It is whether the accountability structures currently in place are sufficient to hold you personally responsible for AI outcomes in a retail environment where consumers cannot see or interrogate the model making decisions about them.

The AI governance implication is immediate. The Mills Review's publication will be followed, within eight days, by the Chancellor's Mansion House speech on 14 July, where the Government's Financial Services AI Adoption Plan is due to be released. If you have not already mapped your AI use cases to your named SMFs, you are already in the gap the Review was commissioned to examine. The question the FCA will be asking is not "does your firm have an AI policy?" The question will be "can you prove, personally, that you acted on your accountability for these AI outputs, in a way that survives regulatory scrutiny?" The Review is expected to make that question unavoidable.

BNPL Regulation: Five Days to Notify, Nineteen Days to Comply

The FCA's regime for Deferred Payment Credit, the formal name for Buy Now Pay Later, goes live on 15 July 2026. The notification window for temporary permission closes on 1 July 2026. That is five days from today. If your firm was carrying on deferred payment credit activity on 15 July 2025 and has not yet notified the FCA, you cannot continue operating legally after the regime commences. The fee to notify is £280. The cost of missing the window is the right to operate.

The scope is wider than you may expect. This is not just the Klarnas and Clearpays. If your firm offers any deferred payment option embedded in a product or service, if you have embedded finance, instalment plans, or act as a distributor of BNPL credit, you have obligations under the new regime. Under the Consumer Duty, you must be personally accountable for customer outcomes. That applies to the AI making the credit decision, the algorithm assessing affordability, and the automated system deciding which offer to surface to which customer at which moment.

The AI governance implication is the part most people in your position have not yet registered. Your credit and affordability models were probably built before Consumer Duty existed and before SM&CR applied to your sector. They are making decisions right now. Is your name attached to those outcomes? Consumer Duty requires that the person responsible for a product's outcome can be identified and held to account. SM&CR, in its application to newly authorised consumer credit firms, extends that personal accountability to you, the senior manager with oversight of the relevant product line. If that product line runs on an AI model, that model needs a named owner who can explain it. In nineteen days, that is not a nice-to-have. It is a regulatory requirement with your name on it.

All three developments this week point to the same structural problem. The FCA is not asking whether your firm has an AI policy. It is asking whether you, the named Senior Manager responsible for an AI-assisted decision, can prove, right now, that you acted on your accountability. That distinction matters more than most people in your position have registered.

SM&CR already assumes accountability sits with you. What it does not create is the evidence body that makes your accountability visible and defensible. When AI is making or materially influencing decisions at scale, whether that is a credit affordability assessment, a transaction monitoring alert, or a regulatory obligation triage, there is a compounding record of human-reviewed decisions building up in real time. Or there is not. You probably do not have one. When the FCA asks, your only available response is to reconstruct the record retrospectively. That is not evidencing reasonable steps. That is damage control with your name on the submission.

BuildMoat builds the evidence body in real time, in two layers. The first is pre-deployment: before any AI system goes near a live decision, you sign off the behavioural envelope, the documented parameters within which the agent is authorised to operate. That sign-off is timestamped, stored, and forms the foundation of your accountability record. The second is pre-commit: at execution level, every agent action is checked against that validated envelope before it proceeds. What the agent did, whether it stayed within the parameters you approved, and what the BuildMoat compliance champion reviewed and signed off is captured continuously as the system runs. Every decision, escalation, and override is cryptographically timestamped and stored.

When the regulator walks in, you do not call a meeting to work out what happened. You open a portal and hand over a complete, contemporaneous record, what you approved before deployment and what happened at every point of execution since. Accountability was always yours under SM&CR. BuildMoat makes sure you can prove it without reconstructing anything.

If the FCA walked in on Monday and asked you to show every AI-assisted decision made in the last ninety days, who reviewed each output before it was acted on, and what your documented sign-off trail looks like, how long would it take you to produce that record? And would what you produce reflect what actually happened, or what you wish had been documented?

If this is a live problem, reply to this email or contact us at [email protected]. BuildMoat builds the real-time evidence infrastructure that proves you acted on your regulatory accountability, before, during, and after automated decisions are made. We work with regulated financial services firms under SM&CR, Consumer Duty, and the FCA's AI governance expectations, where personal accountability is assumed but the evidence that supports it is rarely built until it is too late.

BuildMoat — buildmoat.co.uk

That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.

Forward this to one person who should be reading it.

Find me on X and LinkedIn if you want to continue the conversation there.

For sponsorship enquiries, email [email protected]

Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.

Until next week.