Beyond the FCA's AI Review: The Major Operational Challenge

AI won't simplify it, it will expose it.

The FCA's Mills Review landed a couple of weeks ago, setting out how AI could reshape retail financial services by 2030. It puts seven recommendations to the FCA Board and Executive to consider, among them an "autonomy spectrum" tracking how the human role shifts as AI takes on more autonomy, from operator through to observer, and a new supervisory model to watch for AI-driven risk across the market. It's serious work, and most of the commentary on it has focused on the same thing: governance, accountability, who's responsible when an AI agent acts instead of a person.

That's the right question eventually. But it misses something more basic: whether firms actually know how their own processes work in the first place.

Here's why that matters more than it sounds.

Right now, when a process runs into a gap, an old system that was never decommissioned, two departments with two different answers, a person hits it and quietly works around it. They know to double check, or who to call, or which of the three systems is actually right. That workaround is invisible. It doesn't show up in any risk register because a human absorbed it before it became a problem.

An AI agent doesn't do that. It doesn't know the workaround exists, so it can't apply it. It follows the process as designed, encounters the same gap the person used to quietly patch over, and either acts on incomplete information or fails in a way nobody's watching for, because the whole point of delegating the decision was to remove the person who used to watch.

That's a risk related to the Mills Review, and it isn't really about AI at all. It's that complexity firms have been living with for years, surviving on the back of people's judgement, doesn't disappear when you automate. It just loses its safety net.

Which is why "build in accountability from the start" is good advice but the wrong starting point. You can't make an agent accountable to a map that only holds true on paper. The firms that will get real value from agentic AI, safely, are the ones who go looking for these gaps first, not the ones who find them the hard way after an agent has already acted on one.

That's also an opportunity, not just a warning. Whatever the Board decides on the seven recommendations, the review makes the FCA's direction of travel clear. Firms that start finding and closing these gaps now are getting ahead of that shift, rather than scrambling to catch up once the framework moves to meet it.

This isn't a full operating model redesign, but it isn't a quick fix either. This complexity doesn't show up in the official process map or risk register, because that map shows how the process is supposed to work, not the workarounds people actually use to make it work. Those workarounds live in the heads of the people who've been quietly managing them for years, often spanning several teams and systems that were never designed to talk to each other. Finding them properly means tracing a real journey end to end, not spot-checking one step in isolation.

And this isn't caused by one thing. Acquisition is a common driver, stitching together systems and processes that were never designed to work as one. But firms build up the same complexity through growth, through people leaving and taking knowledge with them, through processes nobody's revisited in years. Most firms don't actually know how much of it they're carrying until someone goes looking properly.

Fix that first, and an agent can be trusted with what's underneath it. Skip the order, and you're not adopting AI, you're finding out where your complexity was hiding, at speed, with nobody left in the process to catch it.

Source: FCA, The Mills Review, July 2026 (fca.org.uk/publications/corporate-documents/mills-review)