Why the FCA’s Mills Review Will Force FinTechs to Overhaul Corporate Governance by 2030

The question dominating the fintech sector is no longer whether regulators will permit advanced artificial intelligence, but rather whom this technology is ultimately going to serve.

In a landmark milestone for global financial regulation, the Financial Conduct Authority (FCA) has published the findings of The Mills Review: AI and the Future of Retail Financial Services. Led by FCA Executive Director Sheldon Mills and explicitly commissioned by the FCA Board, this comprehensive report stands as the first deep-dive assessment of its kind undertaken by a financial regulator globally.

Retail financial services are moving rapidly away from human-led, episodic activities toward a landscape defined by continuous, delegated, and AI-enabled operations by 2030 and beyond. For fintech executives and financial institutions across the UK and US, the roadmap laid out by the FCA provides a critical framework for survival and competitive advantage.

Defining Autonomy Across the Five-Level AI Spectrum

One of the most practical contributions of The Mills Review is its establishment of an AI Autonomy Spectrum. Rather than treating AI as a monolithic tool, the review maps out how the human role fundamentally shifts as systems gain agency.

Firms are advised to evaluate their current deployments against five distinct levels of autonomy.

At Level 1, the human acts as the Operator.

The human uses AI purely as a tool where the AI acts on demand, such as summarizing product terms, explaining account features, or assisting developers with code.

At Level 2, the human acts as a Collaborator where the human and AI plan together.

This involves joint iteration, for example, a finance team co-building financial planning and analysis forecasts or an investigator jointly compiling anti-money laundering case files.

At Level 3, the AI acts as a Consultant.

The AI leads while the human guides, meaning the AI compares market-wide options and builds a switching plan, while the human sets overall preferences and makes the final choice.

At Level 4, the human serves as the Approver.

The AI prepares and the human signs off, meaning the AI agent independently executes tasks, such as executing open banking transfers or drafting a Suspicious Activity Report, but pauses for explicit human authorization at key steps.

Finally, at Level 5, the human becomes an Observer.

The AI executes and the human monitors, leading to fully delegated, continuous operations where the AI continuously optimizes cash balances, resolves customer support tickets end-to-end, and flags anomalies purely by exception.

The Redefinition of Risk: “As autonomy grows, the nature of regulatory risk changes,” notes Sheldon Mills. “As AI moves from recommending to acting, and firms and consumers delegate more, risks shift from harm within a single firm towards system-wide harms.”

Four Systemic Shifts Reshaping the Market by 2030

The review outlines four structural shifts that will alter the velocity, delivery, and competitive dynamics of UK and US retail financial services over the next few years.

1. The Transformation of Firms

AI is moving from peripheral operational assistance into the analytical core of financial institutions. A survey cited in the report reveals that 81 per cent of financial firms are already adopting AI at some level, with 40 per cent operating at advanced stages of scaling. By 2030, leading firms will utilize AI as their primary infrastructure to process information, underwrite credit, handle claims, and evidence compliance outcomes.

2. Consumer Journeys Become Agent-Led

Rather than logging into multiple portals to manually search and compare products, consumers will increasingly hand over control to personal AI agents. Hard data from a nationally representative survey of 5,026 UK adults reveals that 1 in 5 consumers (20 per cent) are already open to letting AI make autonomous decisions for them within pre-set goals. This appetite spikes to 28 per cent among individuals who already use AI regularly. Demand is proving strongest where financial decisions feel highly complex or high-stakes, specifically across debt advice, pensions, and investments. Vulnerable consumers seek structured pathways out of arrears through automated debt advice, whilst others look to AI for simplifying pension pot consolidation, contribution choices, automated portfolio rebalancing, and cash sweeping.

Real-world market indicators are already validating this shift. In the US, platforms like Robinhood and Public are actively permitting clients to connect independent external AI agents directly to their portfolios to execute algorithmic trading strategies based on consumer-set parameters.

3. A Reshaped Competition Landscape

The rise of the AI interface creates an entirely new gatekeeper class. As consumers rely heavily on general-purpose applications, operating-system assistants, or specialised independent agents to manage their finances, whoever owns the AI interface layer captures market power. This layer will dictate product visibility and rank choices, potentially detaching the direct customer relationship from traditional banking brands.

Furthermore, serious upstream dependencies are forming. Financial firms are increasingly tied to a highly concentrated cluster of frontier model providers and hyperscalers, raising red flags over vendor lock-in, sovereign data control, and system-wide points of failure.

4. Amplified Fraud and Cyber Risk

The capabilities empowering fintech innovators are simultaneously weaponized by sophisticated bad actors. By 2030, AI will dramatically scale up the speed and persuasiveness of financial crimes through deepfakes, synthetic identities, and real-time personalized social engineering. In fact, the report highlights recent industry tremors involving Anthropic’s powerful model variants, which forced strict metering due to fears of cybersecurity exploitation targeting Western banking rails.

The Regulatory Move Toward the Agentic Supervisory Model

Crucially for market incumbents, the FCA does not believe a completely new AI rulebook is required. Instead, the regulator maintains that its existing outcomes-based approach, anchored firmly by the Consumer Duty and the Senior Managers Regime (SMR), remains the correct foundation to handle the technology.

Accountability cannot be delegated to an algorithm. Under the SMR, senior executives must still prove they have taken “reasonable steps” to govern automated workflows, monitor model drift, and audit complex third-party AI supply chains.

However, to address the systemic risks of correlated AI behavior and herding across markets, the review introduces a major recommendation for an Agentic Supervisory Model. This operates as an interconnected system of seven priority recommendations.

First, the FCA intends to secure and adapt the regulatory perimeter to evaluate general-purpose large language models handling financial activities. Second, they will strengthen system-wide coordination and oversight with other sectoral regulators. Third, they plan to monitor the transition to autonomous models and continuously adjust compliance baselines. Fourth, the regulator will scale up the FCA’s AI Lab to foster safe model and system innovation. Fifth, they aim to enable the foundations for agentic finance by developing trusted agent protocols. Sixth, they will build and adopt an AI-enabled agentic supervisory model to give the regulator the technical tools required to monitor live market risks. Finally, they will develop a trusted public-interest AI financial capability service to provide safe, accessible financial guidance directly to citizens.

Take on Trust as the Core Business Metric

The quantitative findings of the review reveal a stark warning for fintech firms rushing to automate. Exactly 45 per cent of consumers currently see no tangible benefit to using AI for personal finance, and over two-thirds harbor severe anxiety regarding data misuse (68 per cent) and lack of regulatory protection (67 per cent).

The industry is rapidly approaching a divide. Firms that treat human oversight as a passive rubber stamp risk severe regulatory backlash under the Consumer Duty. Conversely, those that build auditable, explainable neuro-symbolic architectures, respect data sovereignty, and proactively manage their third-party dependencies will convert compliance into their greatest engine for growth.

AI cannot be switched off. The roadmap to 2030 is officially set, and the only remaining choice for fintech leaders is how quickly they will adapt their governance to meet it.