FCA publishes AI good and poor practice for UK financial firms

What the FCA published

The UK Financial Conduct Authority has published a detailed set of examples showing how banks, insurers, lenders and investment firms are using artificial intelligence well and badly. The document, AI in financial services: good practice and areas for improvement, was released on 19 October 2026 alongside a speech by Jessica Rusu, the FCA's chief data, information and intelligence officer, at Bloomberg's UK Policy Series.

Rusu said the examples come from the regulator's observations of firm testing this year. The FCA says it drew on supervisory work, engagement with firms, consumer groups, charities, technology providers and academics, and its AI Lab programmes, including AI Live Testing and the Supercharged Sandbox.

The FCA is clear that this is not a new rulebook. The examples are illustrative, “do not create new requirements” and do not replace firms' own judgement about what is proportionate. The regulator has said before that it will not write AI-specific rules, and instead applies existing ones: the Consumer Duty, the Senior Managers and Certification Regime, its systems-and-controls rules and its operational resilience regime. Rusu said the guidance is not static and will be updated as the technology changes.

The timing reflects how far adoption has gone. Rusu said a joint AI survey with the Bank of England, due to be published the following week, shows 86 percent of firms now use AI.

Consumers first, including vulnerable ones

The first theme is the Consumer Duty, which requires firms to deliver good outcomes for retail customers. The FCA says firms remain responsible for those outcomes whether a person or an AI tool delivers them.

Good practice starts with defining the consumer need before building anything. One firm that wanted more consistent customer information first set clear success measures, considered other approaches and ran a narrow pilot before deciding to scale. Another tested whether vulnerability indicators, such as accessibility needs, were influencing fraud suspicion or claim acceptance, and used the results to reduce unintended outcomes. Rusu highlighted a firm whose chatbot keeps a live list of vulnerability signals and flags customers who may need a human adviser.

The poor practice is just as specific. Some firms built tools without first establishing the consumer problem or foreseeable harms. Some added technical guardrails that fixed one risk and created another: in one case, guardrails that reduced model drift left the tool giving overly generic answers that steered some customers toward unsuitable options. Others automatically excluded anyone with a vulnerability marker from AI journeys, which the FCA says can be unfair if those customers get no equivalent route to support.

On transparency, firms are expected to tell customers when they are dealing with AI, explain its limits and tell them when to seek help elsewhere. Rusu also listed overstating capabilities and launching automated customer journeys without enough testing among the poor practices the FCA had seen.

Governance that comes before launch

Governance is where Rusu said “too many firms are still under-investing.” The paper's sharpest criticism is of what it calls retrospective governance: firms that designed and deployed AI first and only then tried to fit it into rigid existing frameworks, after the key decisions had been made.

One example reads like a warning. A firm deployed AI tools before setting up clear governance. When risks appeared, several teams assumed oversight sat elsewhere and there was no clear route to escalate issues or challenge decisions. Retrofitting governance afterwards proved difficult and left gaps in accountability.

The good examples include structured challenge and sign-off before launch, central AI bodies such as data ethics committees, and an independent review panel drawn from different parts of the business that could demand extra controls before deployment. Smaller firms scaled their existing risk committees with simple risk tiers rather than copying large-firm structures.

Monitoring is another weak spot. The FCA criticises firms that track technical model metrics instead of real-world outcomes, or treat governance as a one-off check. It also found oversight teams without enough AI expertise to challenge what they were reviewing.

Human review is not a cure-all either. The paper warns against excessive reliance on staff checking AI outputs, and describes one firm where the human reviewer's role became “a tick-box exercise over time.”

Senior managers stay on the hook

The accountability section matters most for executives. Under the Senior Managers and Certification Regime, a named senior manager answers for each business area, and the FCA says that includes the AI used there. It does not expect senior managers to be technical specialists, but they must take reasonable steps to understand the risks and provide real challenge.

Poor practice included decisions with thin documentation and no audit trail, which left senior managers unable to show the steps they had taken, and managers who delegated AI development entirely to technical teams without understanding or challenging it. In good examples, ultimate accountability sat with the senior manager for the business area while a separate model owner handled the technical build, and one firm made the responsible executive approve an incident playbook before signing off a tool.

Similar expectations are spreading internationally, as in the Financial Stability Board's 12 sound practices for bank AI and the Hong Kong Monetary Authority's new AI rules for banks.

Planning for AI to fail

The third theme is operational resilience. Rusu's advice was short: stress-test AI systems, plan for failure, keep fallback options and understand dependencies on suppliers, “including reliance on a single model.”

The paper found firms that left AI out of their resilience plans as they moved from low-risk to more important uses, and firms that relied on vendors' assurances without testing them or did too little to avoid dependence on hard-to-replace AI providers. Good practice included contracts that require notice of significant model changes, tested contingency plans for a provider changing its service, and one firm that built its AI service so it did not depend on a single model provider.

The FCA notes that the effect of frontier AI models on cybersecurity is outside the scope of this paper, and points to a separate statement with the Bank of England and the Treasury and a multi-firm review on frontier models and cyber resilience.

Agents, chatbots and the FCA's own AI

Rusu used the speech to look ahead to AI agents that search products, move money and transact with other agents. She said firms' incident reporting must extend to significant AI failures and near-misses, and that agentic systems need “continuous, conditional assurance” because a system safe at launch may behave differently at scale. The FCA plans to work with industry, other regulators and frontier labs on a framework covering agent identity, delegated authority, accountability and execution, the same questions card networks are tackling, as in American Express's framework for agent purchases.

She also addressed general-purpose chatbots. Four in five less-experienced investors aged 18 to 40 have used AI to help with investing, she said, but only 40 percent of consumers know they have no recourse if they act on advice from a general-purpose AI tool. The FCA is asking AI providers to add clear, proportionate and consistent disclaimers, rather than expanding its own remit.

The regulator is using AI itself. Rusu said it is building tools to oversee 60,000 anti-money-laundering firms joining its remit in 2028 and a market first responder agent to supervise about 9,000 small wholesale firms on transaction reporting.

What happens next

The examples form part of the FCA's response to the Mills Review, published in July, on how AI could reshape retail financial services by 2030. Rusu said six of its seven recommendations are being built into live work through testing and supervision rather than more consultation.

The next data point is the FCA and Bank of England survey due the following week, which should show how firms are using AI in more detail. For firms, the practical message is that supervisors will expect to see documented governance, named owners and outcome monitoring for each material AI use case, and that adding them after launch will be treated as a weakness.