The Mechanics of Agentic Finance Regulation: How the FCA's 'Mills Review' Proposes a Roadmap and Expanded Powers Over AI's Critical Third Parties

The era of the financial chatbot is already giving way to something far more autonomous. For the past three years, artificial intelligence in retail finance has largely functioned as a sophisticated conversationalist, summarizing market trends or explaining mortgage rates. Now, the industry is crossing a critical threshold into "agentic finance"—a paradigm where AI systems do not just advise, but actively execute transactions, rebalance portfolios, and sweep cash across accounts on behalf of consumers.[4]

Recognizing that this shift is already underway, the UK's Financial Conduct Authority (FCA) has published the "Mills Review," a landmark regulatory roadmap led by executive director Sheldon Mills. The report represents the first comprehensive attempt by a major global financial regulator to grapple with the mechanics of delegated AI financial decision-making.[1]

The review outlines a future where the financial services industry moves away from episodic, human-led activity toward continuous, AI-enabled management. This transition promises to democratize wealth management, potentially closing the persistent "advice gap" that leaves lower-income households without professional financial guidance. However, it also introduces unprecedented questions about liability, systemic risk, and regulatory boundaries.

Consumer appetite for autonomous financial agents is surprisingly robust, running well ahead of existing regulatory frameworks. Research commissioned by the FCA reveals that a fifth of UK adults—approximately 11 million people—are already open to using AI systems that can act autonomously within pre-set financial goals.[1]

This enthusiasm exists despite a glaring lack of consumer protection. Under current rules, if a human financial advisor makes a negligent recommendation, the consumer has clear avenues for redress and compensation. If an autonomous AI agent hallucinates a market signal and executes a disastrous trade, the liability framework is dangerously ambiguous.[1][4]

The mechanics of agentic finance rely on what the Mills Review terms the "AI autonomy spectrum." At the lowest end, humans use AI as a tool to gather information. In the middle, AI acts as a co-pilot, requiring explicit human sign-off for every action. At the highest end—the agentic tier—the human becomes an observer, monitoring outcomes while the AI system executes tasks continuously within agreed-upon boundaries.

To manage this spectrum, the Mills Review outlines seven priority recommendations for the FCA Board. These include securing and adapting the regulatory perimeter, strengthening system-wide oversight, and enabling the foundational infrastructure required for agentic finance to operate safely.

The most consequential of these recommendations involves a significant expansion of the FCA's authority over "critical third parties" (CTPs). Historically, financial regulators have supervised banks, brokers, and insurers. But the AI models powering agentic finance are built by a handful of massive technology companies, including OpenAI, Anthropic, Google, Amazon, and Microsoft.[1][2]

Because financial institutions are increasingly dependent on these foundation models, the models themselves represent a single point of failure for the financial system. If a major language model experiences a localized outage or a subtle degradation in reasoning capabilities, it could simultaneously impact the trading algorithms, risk assessments, and customer service bots of dozens of banks.[2][3]

The Mills Review argues that the FCA needs direct powers to oversee these critical third parties. This would allow the regulator to probe the resilience, cybersecurity, and operational stability of the tech giants providing the underlying AI infrastructure, ensuring they meet the stringent standards required of financial market utilities.[1][2]

Legal and compliance experts note that while the FCA is not proposing an immediate, standalone "AI rulebook," the regulatory expectations are already shifting. Firms deploying AI are expected to manage the technology through existing governance frameworks, such as the Senior Managers and Certification Regime (SM&CR).[3]

Sheldon Mills has been unequivocal on the issue of accountability, stating that even as systems become more autonomous, "you need a human on the hook for what they're doing." This means that financial institutions cannot outsource their regulatory liability to a third-party AI provider; the firm deploying the agent remains ultimately responsible for its actions.[1][3]

The urgency of clarifying this liability is underscored by the rapid deployment of AI in e-commerce and payments. Recent industry data indicates that 58% of UK online merchants believe AI agents have already transacted on their platforms. Yet, only 41% of those merchants express confidence in the liability frameworks governing those automated transactions.

Beyond regulating the industry, the FCA is also overhauling its own internal mechanics. The review recommends building an "AI-enabled agentic supervisory model." In practice, this means the regulator will deploy its own autonomous AI agents to continuously monitor the behavior of financial firms, analyzing product pricing, market abuse, and consumer outcomes in real-time.

This supervisory pivot acknowledges what Mills has described as an "arms race" between regulators and the financial industry. Traditional rule-making and manual supervision are simply too slow to police markets where millions of AI agents are executing micro-transactions and adjusting portfolios by the millisecond.[1][4]

The review also proposes the development of a trusted, public-interest AI financial capability service. This would provide consumers with a free, baseline AI agent designed to offer impartial guidance on debt management, savings, and budgeting, serving as a safe alternative to commercial models that might harbor hidden incentives.

The implementation of the Mills Review will require careful coordination with other regulatory bodies, including the Competition and Markets Authority and the Information Commissioner's Office. Agentic finance sits at the intersection of financial regulation, data privacy, and antitrust law, meaning no single regulator can oversee it in isolation.[3][4]

Ultimately, the FCA's roadmap represents a critical acknowledgment that the architecture of retail finance is fundamentally changing. By moving to regulate the underlying AI models and demanding clear human accountability for autonomous actions, the UK is attempting to build a framework where the efficiency of agentic finance can scale without compromising the stability of the financial system.[4]