In partnership with
Two FCA consultations, two very different deadlines, and one question for every firm using AI: who makes sure your systems keep up when the rules change?
There is a familiar problem in financial services. A regulator changes the rules, Compliance interprets what that means, Technology updates the systems, and someone has to check that the changes actually work.
Simple enough on paper. In practice, the handoffs are where things get messy.
Now add AI and automation into the mix. A model might still be using yesterday's assumptions. A reporting system might keep classifying transactions the way it always has. And because everything appears to be running normally, nobody notices until something goes wrong.
That is why two new FCA consultations caught my attention this week.
Neither is about AI. Both could have consequences for firms using it.
Discover laptops with built-in intelligence.
Shift your workforce into hyper-productivity mode with Dell Pro laptops powered by Intel® Core™ Ultra with Intel vPro®. Shop on Dell Premier.
1. When investors want their money back
FCA consultation: CP26/35, Fair redemption terms for authorised funds investing in illiquid assets
On 8 October, the FCA published proposals aimed at making redemption terms more appropriate for funds investing in assets that cannot easily be sold, such as property and infrastructure.
The basic problem is easy to understand. If a fund holds assets that take months to sell, promising investors quick access to their money creates a mismatch.
The FCA wants redemption terms to reflect the time it typically takes to sell those assets. Trade press reports have referred to a proposed 90-day notice period, although firms should check the consultation paper itself before relying on that figure.
The consultation closes on 11 December 2026, with final rules expected in the first half of 2027.
And this is not just a fund manager's problem. Depending on their role in the distribution chain, platforms, pension providers, advisers, depositaries and providers of unit-linked life products could also be affected.
So where does AI come into this?
Think about the systems a firm might already be using to forecast redemption requests, assess liquidity risk, value assets or decide which products are suitable for customers.
Those systems work from assumptions. How quickly can assets be sold? How much cash might investors need? What happens if more people request their money at the same time?
If the rules change but the assumptions do not, the technology can carry on producing answers that look perfectly reasonable but no longer reflect the firm's obligations.
The awkward question is not whether the model works. It is whether anyone has checked that it is still working against the right assumptions.
Who reviews those assumptions when the rules change? Who approves the changes? And who can show that the firm considered the impact on customers?
Under the Senior Managers and Certification Regime (SM&CR), accountability cannot simply disappear into a model or a technology team. The Consumer Duty also means firms need to consider whether their products and services deliver good outcomes for retail customers.
If your firm relies on automated systems to support these decisions, this consultation is a good reason to revisit the assumptions behind them.
2. When the definition of a trade changes
FCA consultation: CP26/34, Preparing for the new transaction reporting regime
The second consultation deals with transaction reporting, a less visible but equally important part of financial services.
Investment firms have to report certain transactions to the regulator. Those reports depend on detailed rules about what counts as a transaction, how information should be classified and which fields need to be populated.
The FCA is preparing for a new regime that will move transaction reporting obligations into its Handbook, following the planned repeal of the existing UK MiFIR transaction reporting legislation.
The consultation covers guidance on seven areas, including client indicators, conditional single-sided reporting, branch execution, equity swaps, strike prices and package transactions.
The consultation closes on 6 November 2026. The new rules are scheduled to take effect on 3 April 2028, with a final Transaction Reporting User Pack due by 3 April 2027.
That is a long runway. It is also a lot of time for firms to assume that somebody else is dealing with it.
Many firms rely on automated reporting pipelines to classify trades, reconcile information and repair rejected reports. Some use machine learning as part of those processes.
These systems do not automatically understand a change in regulatory guidance. They follow the logic they have been given.
Suppose a reporting field needs to be interpreted differently. Compliance understands the change, but the requirement does not make it into the technical specification. The developer updates one part of the process, but another system continues using the old logic.
The result could be thousands of reports processed using an interpretation that the firm no longer intends to follow.
The system has not necessarily malfunctioned. It may be doing exactly what it was built to do.
That is what makes this a governance problem, not just a technology problem.
Someone needs to interpret the guidance, assess which systems are affected, approve the required changes and confirm that testing has been completed.
There also needs to be a record of those decisions. If the FCA asks why a reporting process works the way it does, the firm should not have to reconstruct the answer from emails and conversations.
The consultation is an opportunity to raise questions while the guidance is still being shaped. Firms should use it to identify unclear requirements and prepare for the implementation work ahead.
The common problem is what happens between the rulebook and the system
These consultations have different timelines and different regulatory objectives. But they highlight a problem I keep coming back to when thinking about AI accountability in financial services.
Having a policy is not the same as having a working control.
A firm can have an AI policy, a model inventory and a named Senior Manager. Yet when a regulatory requirement changes, there may be no clear process connecting that change to the systems affected by it.
Who spots the change?
Who determines its impact?
Who makes sure the right person owns the work?
Who confirms that the system has been updated and tested?
And where is the evidence that all of this happened?
These are not abstract questions about responsible AI. They are ordinary operational questions that become more important as firms rely on automated systems to make decisions and process information at scale.
Under SM&CR, relevant Senior Managers need to understand the responsibilities attached to their roles. That does not mean they personally have to update every model or inspect every line of code. It does mean firms need clear ownership, appropriate oversight and evidence that their controls are working.
The same principle applies whether the system uses machine learning, a conventional rules engine or a mixture of both.
The technology may change. The need for accountability does not.
Three things to do now
If you work in Compliance, Risk, Operations or Technology, here is where I would start.
1. Map the regulatory change to the systems it could affect.
Do not stop at the policy document. Identify the models, automated workflows, reporting pipelines and downstream decisions that rely on the relevant rules or assumptions.
2. Assign an owner to the change.
Make it clear who interprets the requirement, who coordinates implementation, who tests the outcome and who approves the change. Avoid leaving responsibility spread across several teams without one person accountable for driving it through.
3. Keep evidence of the decision and the outcome.
Record what changed, why it changed, which systems were affected, what testing was performed and who signed it off. If something cannot be evidenced, it becomes much harder to demonstrate that the control worked.
For the transaction reporting consultation, the immediate priority is the 6 November deadline. For the fund redemption proposals, firms have until 11 December to respond. Neither should wait until the final rules arrive before someone starts thinking about the operational impact.
One question for your next risk meeting
When a regulatory change affects the assumptions behind one of your automated systems, can you trace the journey from the new requirement to the technical change, the testing and the person who approved it?
Or would your team have to piece that story together after the fact?
That is the gap BuildMoat is concerned with: not simply whether firms are adopting AI, but whether they have the controls, ownership and evidence to remain accountable for how it is used.
Because when the rules change, your systems will not necessarily know. Someone in your firm needs to make sure they do.
If this is a challenge in your organisation, get in touch with BuildMoat to discuss how to connect AI deployment with practical regulatory accountability.
Thanks for reading
That's it for this week. If something landed, reply and tell me. If something was wrong, reply and tell me that too. I read every response.
Forward this to one person who should be reading it.
For sponsorship enquiries, email [email protected]
Regulatory commentary is for informational purposes only and does not constitute legal, compliance, or financial advice. Consult a qualified professional for advice specific to your firm. BuildMoat product mentions are editorially assessed and disclosed where a conflict exists.
Until next week.
