The UK's Financial Conduct Authority is choosing personal accountability over new statute to govern artificial intelligence across the financial sector, coupling existing senior-manager liability with mandatory AI failure reporting and a hiring push to build internal expertise. ANALYSIS The approach amounts to a deliberate regulatory wager: that the threat of individual consequences will discipline AI adoption faster than rulemaking can keep pace with the technology.
Why it matters
A forthcoming joint survey by the FCA and the Bank of England shows 86 per cent of regulated firms now use AI3,7,10. Four in five less-experienced investors aged 18 to 40 have used AI to help with investing, yet only 40 per cent of consumers recognise they have no recourse if something goes wrong after acting on advice from a general-purpose AI tool6. ◆ That gap between adoption speed and consumer awareness is the condition the FCA is now trying to address without writing a single new rule.
The big picture
Jessica Rusu, the FCA's chief data, information and intelligence officer, told Bloomberg's UK Policy Series on 19 October that the regulator expects senior managers to answer personally for the AI systems in their business areas. "Poorly governed AI can create consumer harm, cyber vulnerabilities, and operational failures, potentially at much greater speed and scale," she said1.
Rather than consulting on fresh regulation, the FCA said it would focus on testing, assurance, monitoring and surveillance with industry, and is putting six of the Mills Review's seven recommendations into live work. The Mills Review, which the FCA commissioned to examine how AI could reshape retail financial services by 2030, was published in July.
Alongside the speech, the FCA published examples of good and poor practice covering three areas: consumer centricity, accountability and governance, and operational resilience5. On the good-practice side, one firm built a live list of vulnerability signals so that its chatbots could flag consumers who need extra support from human advisers, and another set up an independent ethics panel to examine each AI use case before deployment. Poor practice included developing AI tools without a clearly defined consumer need, excluding vulnerable consumers by default, overstating capabilities, and deploying automated customer journeys without sufficient testing.
Rusu also called on AI providers, naming ChatGPT, Gemini and Claude, to put "clear, proportionate and consistent disclaimers" on financial advice generated by their large language models. "Our answer is not simply to expand our remit, but to make the existing boundary clearer," she said. Warnings delivered at the point where AI-generated financial information reaches the consumer, Rusu argued, may prove more effective than existing awareness campaigns9.
On incident reporting, Rusu was explicit: "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses. As the AI Minister has recognized, near-miss reporting for agentic AI is becoming a national security priority. It is a regulatory priority too".
ANALYSIS The FCA's posture carries a specific logic. By declining new rules, the regulator avoids the lag inherent in consultation-and-codification cycles while still raising the cost of negligence. The Senior Managers Regime already attaches personal liability to named individuals; extending its reach to AI systems means every deployment decision carries career risk for the executive who signs off on it. The simultaneous demand for near-miss reporting creates an information pipeline the FCA can use to identify systemic patterns before they become crises.
The hiring drive reinforces the strategy. The FCA received hundreds of applications for two senior AI roles, including a Head of Agentic AI and Data Science Research, with salaries ranging from £140,000 to £190,000 in London2. Rusu said candidates were attracted by the opportunity to tackle "fascinating and interesting problems" despite potentially higher pay at AI companies. The regulator is developing AI tools to monitor anti-money laundering controls at an additional 60,000 firms under a new responsibility taking effect in 2028, and deploying agentic AI agents to help supervise approximately 9,000 small wholesale market firms that report transaction data.
The FCA's expanding remit over its 35,500 supervised firms, plus the 60,000 additional firms arriving in 2028, underpins the internal AI build. ANALYSIS Automated surveillance becomes a practical necessity at that scale, not just an ambition, and the regulator is building its own AI capacity on two fronts simultaneously: internal tooling for supervision and external governance through liability rather than prescription.
What's next
The joint FCA and Bank of England AI survey is due for publication the week following Rusu's speech. The FCA said it would work with industry, other regulators and frontier AI labs on a framework for agentic finance covering agent identity, delegated authority, accountability and execution. The new anti-money laundering supervision responsibility covering 60,000 additional firms takes effect in 2028. Whether liability-first governance proves sufficient will depend on how quickly the regulator can convert near-miss reports into supervisory action, and whether firms treat personal accountability as a genuine constraint or a compliance formality.