A Regulator Sounds the Alarm on Delegated Decisions
The United Kingdom's Financial Conduct Authority has published a report calling for tougher artificial intelligence rules as autonomous agents begin to make financial decisions on behalf of consumers. The document, released on July 6, reflects a regulator grappling in real time with a shift that few oversight frameworks anticipated. Sheldon Mills, the FCA's Executive Director, framed the change bluntly, noting that AI will reshape consumer financial journeys, with people increasingly delegating to AI applications that act on their behalf. When a customer stops choosing a product and instead instructs an agent to choose for them, the entire architecture of consumer protection, built around informed human consent, starts to wobble.
We find the FCA's candor refreshing and its timing shrewd. Rather than wait for agentic banking to become entrenched and then scramble to regulate it retroactively, the regulator is staking out its concerns while the market is still forming. That is a departure from the usual pattern, in which financial innovation races ahead and supervision arrives years later after harm has accumulated. Whether the FCA can translate early warning into effective rules is another question, but the instinct to engage before the technology hardens into infrastructure is precisely the posture we wish more regulators, in more sectors, would adopt toward AI.
The Promise and the Peril of Agentic Finance
The FCA's report is notably balanced, acknowledging that agentic AI could address long standing failures in consumer finance. Low switching rates, where customers languish on poor value products out of inertia, could fall sharply if an agent continuously shops the market on a customer's behalf. The persistent advice gap, in which millions cannot afford professional guidance, might narrow if capable agents democratize sophisticated financial reasoning. Hyper personalization could, in principle, deliver better outcomes tailored to each individual's circumstances rather than the crude segments that dominate today's mass market products.
Against those benefits the regulator sets a sober list of risks. Bias embedded in models could systematically disadvantage certain customers while wearing the veneer of objective computation. Opaque pricing could let providers exploit the informational asymmetry between an agent and the human it serves. Most striking is the warning about personalized manipulation, the prospect that a system optimizing for engagement or provider profit could nudge individuals against their own interests with surgical precision. We think this last concern deserves the most attention, because an agent that knows a customer intimately and answers to a commercial master is a genuinely novel hazard that existing conduct rules were never designed to catch.
An Arms Race the Regulator Admits It Is Losing
Perhaps the report's most consequential admission is Mills's characterization, delivered to the Financial Times, that regulators face an arms race and need greater authority to monitor AI's rapid evolution. This is an unusually frank acknowledgment that the supervisory toolkit is outmatched by the pace and opacity of the technology it must govern. Financial regulation has always depended on the ability to inspect, understand, and if necessary constrain the products firms sell. When those products are large language models whose behavior emerges from billions of parameters, the traditional inspection model strains, and the regulator is left asking for powers it does not yet possess.
The FCA specifically seeks expanded authority to regulate general purpose models such as ChatGPT and Claude when they intermediate financial decisions. That ambition raises thorny jurisdictional questions, because the developers of foundation models are typically technology companies far outside the traditional perimeter of financial supervision. We suspect this tension, between sector regulators who see AI reshaping their domains and horizontal model providers who do not consider themselves financial firms, will define the next several years of policy fights. The FCA is early to name it, but it will not be the last regulator to discover that the thing it most needs to oversee sits outside its legal reach.
Regulators Must Become AI Adopters Themselves
A quieter but important thread in the report is the argument that financial regulators must adopt AI themselves to match the pace of industry change. This is the corollary that too many oversight bodies resist. A regulator armed only with spreadsheets and periodic filings cannot meaningfully supervise firms deploying autonomous agents that act thousands of times per second. Effective oversight of AI intermediated markets will require supervisory technology capable of monitoring model behavior, detecting emergent harms, and testing systems at machine speed. The FCA appears to understand that it cannot police a capability it does not itself possess.
We would go further and argue this is the defining institutional challenge for regulators across every sector, not just finance. The asymmetry between well resourced firms deploying frontier AI and public bodies operating on constrained budgets with legacy tooling is stark and growing. Closing it will require investment, talent, and a cultural shift inside regulators that historically prized caution over technical fluency. The alternative is supervision in name only, a comforting fiction in which rules exist on paper while the actual behavior of AI systems runs unobserved. The FCA's willingness to say this out loud is a useful marker of how seriously the smartest regulators now take the problem.
What Financial Institutions Should Do Ahead of the Rules
For banks, insurers, and fintechs, the strategic reading is that agentic finance is coming and the rules governing it are being drafted now, in public, by a regulator inviting input. Institutions that treat this as an opportunity to shape sensible frameworks, rather than a threat to resist, will fare better than those that wait to be told what to do. The firms best positioned will be those that build governance into their agentic products from the outset, with auditable decision logs, clear accountability for agent behavior, and honest disclosure to customers about when and how an agent is acting on their behalf.
The deeper lesson extends to any enterprise deploying autonomous agents in high stakes domains. Regulators watching finance are a leading indicator for regulators watching healthcare, legal services, and other consequential fields where agents will soon make decisions that affect people's lives. The governance disciplines the FCA is gesturing toward, explainability, accountability, containment, and protection against manipulation, are precisely the disciplines every serious agentic deployment will eventually need. Organizations that build them now, ahead of the mandate, will find compliance a formality rather than a fire drill. Those that wait will discover, as they always do, that retrofitting governance onto a live system is far more painful than designing it in.
